System and method for performing replica copying using a physical copy mechanism

ABSTRACT

A system that implements a data storage service may maintain tables in a data store on behalf of clients. The service may maintain table data in multiple replicas of partitions of the data that are stored on respective computing nodes in the system. In response to detecting a failure or fault condition, or receiving a service request from a client to move or copy a partition replica, the data store may copy a partition replica to another computing node using a physical copy mechanism. The physical copy mechanism may copy table data from physical storage locations in which it is stored to physical storage locations allocated to a destination replica on the other computing node. During copying, service requests to modify table data may be logged and applied to the replica being copied. A catch-up operation may be performed to apply modification requests received during copying to the destination replica.

This application is a continuation of U.S. patent application Ser. No.13/174,275, filed Jun. 30, 2011, now U.S. Pat. No. 8,732,517, which isincorporated herein by reference in its entirety.

BACKGROUND

Several leading technology organizations are investing in buildingtechnologies that sell “software-as-a-service”. Such services provideaccess to shared storage (e.g., database systems) and/or computingresources to clients, or subscribers. Within multi-tier e-commercesystems, different resources may be allocated to subscribers and/ortheir applications from whole machines, to CPU, to memory, to networkbandwidth, and to I/O capacity.

Database systems managing large amounts of data on behalf of users maydistribute and/or replicate that data across two or more machines, oftenin different locations, for any of a number of reasons, includingsecurity issues, disaster prevention and recovery issues, data localityand availability issues, etc. These machines may be configured in anynumber of ways, including as a shared resource pool.

Interaction between client applications and database servers typicallyincludes read operations (read-only queries), write operations (to storedata), and update operations that can be conceptualized using aread-modify-write workflow.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram illustrating one embodiment of a systemarchitecture that is configured to implement a web services-based datastorage service.

FIGS. 2A-2C are block diagrams illustrating various components of a Webservices platform, according to one embodiment.

FIGS. 3A and 3B are block diagrams illustrating the storing of data asitems in a plurality of tables, according to one embodiment.

FIG. 4 is a block diagram illustrating three items that contain anumeric attribute that has been designated as the primary key for thetable in which they are stored, according to one embodiment.

FIG. 5 is a flow diagram illustrating one embodiment of a method forcreating a table to be maintained by a data storage service on behalf ofa storage service client.

FIG. 6 is a flow diagram illustrating one embodiment of a method forcreating a table in response to a request received through a webservices API.

FIG. 7 is a flow diagram illustrating one embodiment of a method forgenerating table metadata.

FIG. 8 is a flow diagram illustrating one embodiment of a CreateTableworkflow.

FIG. 9 is a flow diagram illustrating one embodiment of a method forupdating an item in response to a request to do so.

FIG. 10 is a flow diagram illustrating one embodiment of a method forupdating an item using an API that supports conditional updates and/ormultiple output options.

FIG. 11 is a flow diagram illustrating one embodiment of a method forpartitioning a table maintained in a non-relational data store.

FIG. 12 is a flow diagram illustrating one embodiment of a method forperforming a query.

FIG. 13 is a flow diagram illustrating another embodiment of a methodfor performing a query.

FIG. 14 is a flow diagram illustrating one embodiment of a method forperforming a table scanning operation.

FIG. 15 is a flow diagram illustrating a method for performing a queryor scan operation for which a scan or response limit has been specified,according to one embodiment.

FIG. 16 is a block diagram illustrating a portion of a data model for asystem that provides data storage services, according to one embodiment.

FIG. 17 is a flow diagram illustrating one embodiment of a method forcreating and managing a table on behalf of a data storage service clientusing a preferred throughput model.

FIG. 18 is a flow diagram illustrating one embodiment of a method forservicing requests directed to a particular table while maintaining ormodifying a committed throughput level.

FIG. 19 is a flow diagram illustrating one embodiment of a method formoving a replica of a partition of a table being maintained by a datastorage service on behalf of a storage service client while thepartition is “live”.

FIG. 20 is a flow diagram illustrating one embodiment of a method forcopying a replica using a physical copy mechanism.

FIG. 21 is a flow diagram illustrating one embodiment of a method forsplitting a partition of a table being maintained by a data storageservice in response to a request to do so.

FIG. 22 is a flow diagram illustrating one embodiment of a method formoving a partition of a table being maintained by a data storage servicein response to detecting an anomaly.

FIG. 23 is a flow diagram illustrating one embodiment of a method formoving or splitting a partition of a table being maintained by a datastorage service in response to detecting a hot spot on a storage node.

FIG. 24 is a flow diagram illustrating one embodiment of a method formaintaining and managing a plurality of tables on behalf of one or morestorage service clients.

FIG. 25 is a block diagram illustrating a computing node that may besuitable for implementation of a data storage service, according to oneembodiment.

While embodiments are described herein by way of example for severalembodiments and illustrative drawings, those skilled in the art willrecognize that the embodiments are not limited to the embodiments ordrawings described. It should be understood, that the drawings anddetailed description thereto are not intended to limit embodiments tothe particular form disclosed, but on the contrary, the intention is tocover all modifications, equivalents and alternatives falling within thespirit and scope as defined by the appended claims. The headings usedherein are for organizational purposes only and are not meant to be usedto limit the scope of the description or the claims. As used throughoutthis application, the word “may” is used in a permissive sense (i.e.,meaning having the potential to), rather than the mandatory sense (i.e.,meaning must). Similarly, the words “include”, “including”, and“includes” mean including, but not limited to.

DETAILED DESCRIPTION OF EMBODIMENTS

The systems and methods described herein may be employed in variouscombinations and in various embodiments to implement a Web-based servicethat provides data storage services to storage service clients (e.g.,user, subscribers, or client applications that access the data storageservice on behalf of users or subscribers). As described in detailherein, the service may in some embodiments support the seamless scalingof tables that are maintained on behalf of clients in a non-relationaldata store, e.g., a non-relational database. The service may provide ahigh level of durability and availability through replication, in someembodiments. In some embodiments, the service itself may not impose amaximum table size or maximum throughput limits, and may not requireclient-side partitioning, even for tables having a massive scale. Theservice may support automatic live repartitioning of data in response tothe detection of various anomalies (e.g., failure or fault conditions,hot spots, or increases in table size and/or service requestthroughput), and/or explicit (e.g., pro-active and/orsubscriber-initiated) live repartitioning of data to support planned oranticipated table size and/or throughput increases. In other words, theservice may in some embodiments initiate the re-sizing (scaling) and/orrepartitioning of a table in response to receiving one or more requeststo store, retrieve, modify, or delete items in the scalable table.

The service described herein may in various embodiments support aflexible schema, a plurality of available consistency models, a varietyof service level and/or business model options, multiple indexingoptions, and/or multiple query types. In some embodiments, storageservice clients (e.g., users, subscribers or client applications) mayinteract with the service through a Web service interface using arelatively small (and relatively simple) set of APIs, such that clientsof the service are largely relieved from the burden of databaseadministration. The service may exhibit low latency in servicingrequests. Unlike in some prior data storage services, the service maypredictable performance at a low cost, while supporting multi-tenancyand automatic heat management.

In various embodiments, the data storage service described herein mayprovide an application programming interface (API) that includes supportfor some or all of the following operations on the data in a tablemaintained by the service on behalf of a storage service client: put (orstore) an item, get (or retrieve) one or more items having a specifiedprimary key, delete an item, update the attributes in a single item,query for items using an index, and scan (e.g., list items) over thewhole table, optionally filtering the items returned. In someembodiments, the service (and/or the underlying system that implementsthe service) may support a strong consistency model, in addition tosupporting eventually consistent read operations. In some embodiments,service requests made via the API may include an indication of one ormore user preferences, such as a preferred consistency model, apreferred service request throughput level, or a service requestthroughput level for which a guarantee is requested. In otherembodiments, some or all of these user preferences may be specified whena table is created, or may be client-specific, account-specific,specific to various table types, or specified by system-wide defaultvalues, rather than being specified on a per-request basis. The API maysupport extreme scaling and/or more predictable performance than thatprovided by prior data storage systems and services.

In some embodiments, the service (and/or the underlying system) mayimpose an upper bound on the size of an individual item, e.g., to allowthe service to store the entire contents of an item in a singlepartition in the underlying data storage system. This may, in turn,facilitate performing atomic updates to an item without dramaticallyreducing throughput, and may make it easier to maintain item contents ina stable working set. In other words, limiting the size of an individualitem may facilitate both strong consistency and high performance in thesystem, in some embodiments.

One embodiment of a system architecture that is configured to implementa Web services-based data storage service such as that described hereinis illustrated in FIG. 1. It is noted that where one or more instancesof a given component may exist, reference to that component hereinbelowmay be made in either the singular or the plural. However, usage ofeither form is not intended to preclude the other. In variousembodiments, the components illustrated in FIG. 1 may be implementeddirectly within computer hardware, as instructions directly orindirectly executable by computer hardware (e.g., a microprocessor orcomputer system), or using a combination of these techniques. Forexample, the components of FIG. 1 may be implemented by a distributedsystem including a number of computing nodes (or simply, nodes), such asthe computer node embodiment illustrated in FIG. 22 and discussed below.In various embodiments, the functionality of a given storage servicesystem component may be implemented by a particular computing node ormay be distributed across several computing nodes. In some embodiments,a given computing node may implement the functionality of more than onestorage service system component.

Generally speaking, storage service clients 110 a-110 n may encompassany type of client configurable to submit web services requests to Webservices platform 130 via network 120. For example, a given storageservice client 110 may include a suitable version of a web browser, or aplugin module or other type of code module configured to execute as anextension to or within an execution environment provided by a webbrowser to provide storage service clients (e.g., client applications,users, and/or subscribers) access to the data storage services providedby Web services platform 130. Alternatively, a storage service client110 may encompass an application such as a database application, mediaapplication, office application or any other application that may makeuse of persistent storage resources. In some embodiments, such anapplication may include sufficient protocol support (e.g., for asuitable version of Hypertext Transfer Protocol (HTTP)) for generatingand processing web services requests without necessarily implementingfull browser support for all types of web-based data. That is, storageservice client 110 may be an application configured to interact directlywith Web services platform 130. In various embodiments, storage serviceclient 110 may be configured to generate web services requests accordingto a Representational State Transfer (REST)-style web servicesarchitecture, a document- or message-based web services architecture, oranother suitable web services architecture.

In some embodiments, storage service client 110 may be configured toprovide access to web services-based storage to other applications in amanner that is transparent to those applications. For example, storageservice client 110 may be configured to integrate with an operatingsystem or file system to provide storage in accordance with a suitablevariant of the storage model described herein. However, the operatingsystem or file system may present a different storage interface toapplications, such as a conventional file system hierarchy of files,directories and/or folders. In such an embodiment, applications may notneed to be modified to make use of the storage system service modeldescribed herein. Instead, the details of interfacing to Web servicesplatform 130 may be coordinated by storage service client 110 and theoperating system or file system on behalf of applications executingwithin the operating system environment.

Storage service clients 110 may convey web services requests to andreceive responses from Web services platform 130 via network 120. Invarious embodiments, network 120 may encompass any suitable combinationof networking hardware and protocols necessary to establish web-basedcommunications between clients 110 and platform 130. For example,network 120 may generally encompass the various telecommunicationsnetworks and service providers that collectively implement the Internet.Network 120 may also include private networks such as local areanetworks (LANs) or wide area networks (WANs) as well as public orprivate wireless networks. For example, both a given client 110 and Webservices platform 130 may be respectively provisioned within enterpriseshaving their own internal networks. In such an embodiment, network 120may include the hardware (e.g., modems, routers, switches, loadbalancers, proxy servers, etc.) and software (e.g., protocol stacks,accounting software, firewall/security software, etc.) necessary toestablish a networking link between given client 110 and the Internet aswell as between the Internet and Web services platform 130. It is notedthat in some embodiments, storage service clients 110 may communicatewith Web services platform 130 using a private network rather than thepublic Internet. For example, clients 110 may be provisioned within thesame enterprise as the data storage service (and/or the underlyingsystem) described herein. In such a case, clients 110 may communicatewith platform 130 entirely through a private network 120 (e.g., a LAN orWAN that may use Internet-based communication protocols but which is notpublicly accessible).

Generally speaking, Web services platform 130 may be configured toimplement one or more service endpoints configured to receive andprocess web services requests, such as requests to access tablesmaintained on behalf of clients/users by a data storage service, and/orthe items and attributes stored in those tables. For example, Webservices platform 130 may include hardware and/or software configured toimplement various service endpoints and to properly receive and processHTTP-based web services requests directed to those endpoints. In oneembodiment, Web services platform 130 may be implemented as a serversystem configured to receive web services requests from clients 110 andto forward them to various components that collectively implement a datastorage system for processing. In other embodiments, Web servicesplatform 130 may be configured as a number of distinct systems (e.g., ina cluster topology) implementing load balancing and other requestmanagement features configured to dynamically manage large-scale webservices request processing loads.

As illustrated in FIG. 1, Web services platform 130 may include a frontend module 140 (which may be configured to receive, authenticate, parse,throttle and/or dispatch service requests, among other things), one ormore administrative components, or auto admin instances, 150 (which maybe configured to provide a variety of visibility and/or controlfunctions, as described in more detail below), and a plurality ofstorage node instances (shown as 160 a-160 n), each of which maymaintain and manage one or more tables on behalf of clients/users or onbehalf of the data storage service (and its underlying system) itself.Some of the functionality provided by each of these types of componentsis described in more detail below, according to various embodiments.

In various embodiments, Web services platform 130 may be configured tosupport different types of web services requests. For example, in someembodiments, platform 130 may be configured to implement a particularweb services application programming interface (API) that supports avariety of operations on tables that are maintained and managed onbehalf of clients/users by the data storage service system (and/or datastored in those tables). Examples of the operations supported by such anAPI are described in more detail below.

In addition to functioning as an addressable endpoint for clients' webservices requests, in some embodiments Web services platform 130 mayimplement various client management features. For example, platform 130may coordinate the metering and accounting of client usage of webservices, including storage resources, such as by tracking theidentities of requesting clients 110, the number and/or frequency ofclient requests, the size of tables and/or items stored or retrieved onbehalf of clients 110, overall storage bandwidth used by clients 110,class of storage requested by clients 110, and/or any other measurableclient usage parameter. Platform 130 may also implement financialaccounting and billing systems, or may maintain a database of usage datathat may be queried and processed by external systems for reporting andbilling of client usage activity. In some embodiments, platform 130 mayinclude a lock manager and/or a bootstrap configuration (not shown).

In various embodiments, a data storage service may be implemented on oneor more computing nodes that are configured to perform the functionalitydescribed herein. In some embodiments, the service may be implemented bya Web services platform (such as Web services platform 130 in FIG. 1)that is made up of multiple computing nodes, each of which may performone or more of the functions described herein. Various collections ofthe computing nodes may be configured to provide the functionality of anauto-admin cluster, a cluster of resources dedicated to the data storageservice, and a collection of external resources (which may be sharedwith other Web services or applications, in some embodiments).

In some embodiments, the external resources with which the systeminteracts to provide the functionality described herein may include asimple workflow component, illustrated in FIG. 1 as simple workflowcomponent 170. Simple workflow component 170 may provide a frameworkthrough which other components interact with the simple workflow system.In some embodiments, Web services platform 130 may include an access APIbuilt on top of that framework (not shown). This interface may allow thesystem to implement APIs suitable for the usage patterns expected to beexperienced by the data storage service. In some embodiments, componentsor modules of the system that use simple workflow component 170 mayinclude these interfaces rather than interfacing directly to theinterfaces provided by simple workflow component 170. In someembodiments, the Web services platform 130 may rely on one or moreexternal resources, such as an external storage service 180, and/orother external (and in some cases shared) external resources, inaddition to a simple workflow component 170. In some embodiments, simpleworkflow component 170 may be used to perform distributed operations,such as those that extend beyond a particular partition replicationgroup.

FIGS. 2A-2C illustrate various elements or modules that may be includedin each of the types of components of Web services platform 130,according to one embodiment. As illustrated in FIG. 2A, front end module140 may include one or more modules configured to perform parsing and/orthrottling of service requests (shown as 210), authentication and/ormetering of service requests (shown as 215), dispatching servicerequests (shown as 225), and/or maintaining a partition map cache (shownas 230). In addition to these component-specific modules, front endmodule 140 may include components that are common to multiple types ofcomputing nodes that collectively implement Web services platform 130,such as a message bus (shown as 235) and/or a dynamic configurationmodule (shown as 240). In other embodiments, more, fewer, or differentelements may be included in front end module 140, or any of the elementsillustrated as being included in front end module 140 may be included inanother component of Web services platform 130 or in a componentconfigured to interact with Web services platform 130 to provide thedata storage services described herein.

As illustrated in FIG. 2B, auto admin instance 150 may include one ormore modules configured to provide visibility and control to systemadministrators (shown as 245), or to perform heat balancing (shown as250), and/or anomaly control (shown as 255), resource allocation (shownas 260). Auto admin instance 150 may also include an admin console 265,through which system administrators may interact with the data storageservice (and/or the underlying system). In some embodiments, adminconsole 265 may be the primary point of visibility and control for thedata storage service (e.g., for configuration or reconfiguration bysystem administrators). For example, admin console 265 may beimplemented as a relatively thin client that provides display andcontrol functionally to system administrators and/or other privilegedusers, and through which system status indicators, metadata, and/oroperating parameters may be observed and/or updated. In addition tothese component-specific modules, auto admin instance 150 may alsoinclude components that are common to the different types of computingnodes that collectively implement Web services platform 130, such as amessage bus (shown as 235) and/or a dynamic configuration module (shownas 240). In other embodiments, more, fewer, or different elements may beincluded in auto admin instance 150, or any of the elements illustratedas being included in auto admin instance 150 may be included in anothercomponent of Web services platform 130 or in a component configured tointeract with Web services platform 130 to provide the data storageservices described herein.

As illustrated in FIG. 2C, storage node instance 160 may include one ormore modules configured to provide partition management (shown as 270),to implement replication and failover processes (shown as 275), and/orto provide an application programming interface (API) to underlyingstorage (shown as 280). As illustrated in this example, each storagenode instance 160 may include a storage engine 285, which may beconfigured to maintain (i.e. to store and manage) one or more tables(and associated table data) in storage 280 (which in some embodimentsmay be a non-relational database) on behalf of one or moreclients/users. In addition to these component-specific modules, storagenode instance 160 may include components that are common to thedifferent types of computing nodes that collectively implement Webservices platform 130, such as a message bus (shown as 235) and/or adynamic configuration module (shown as 240). In other embodiments, more,fewer, or different elements may be included in storage node instance160, or any of the elements illustrated as being included in storagenode instance 160 may be included in another component of Web servicesplatform 130 or in a component configured to interact with Web servicesplatform 130 to provide the data storage services described herein.

The systems underlying the data storage service described herein maystore data on behalf of storage service clients (e.g., clientapplications, users, and/or subscribers) in tables containing items thathave one or more attributes. In some embodiments, the data storageservice may present clients/users with a data model in which each tablemaintained on behalf of a client/user contains one or more items, andeach item includes a collection of attributes. The attributes of an itemmay be a collection of name-value pairs, in any order. In someembodiments, each attribute in an item may have a name, a type, and avalue. Some attributes may be single valued, such that the attributename is mapped to a single value, while others may be multi-value, suchthat the attribute name is mapped to two or more values. In someembodiments, the name of an attribute may always be a string, but itsvalue may be a string, number, string set, or number set. The followingare all examples of attributes: “ImageID”=1, “Title”=“flower”,“Tags”={“flower”, “jasmine”, “white”}, “Ratings”={3, 4, 2}. The itemsmay be managed by assigning each item a primary key value (which mayinclude one or more attribute values), and this primary key value mayalso be used to uniquely identify the item. In some embodiments, a largenumber of attributes may be defined across the items in a table, buteach item may contain a sparse set of these attributes (with theparticular attributes specified for one item being unrelated to theattributes of another item in the same table), and all of the attributesmay be optional except for the primary key attribute(s). In other words,unlike in traditional databases, the tables maintained by the datastorage service (and the underlying storage system) may have nopre-defined schema other than their reliance on the primary key. Notethat in some embodiments, if an attribute is included in an item, itsvalue cannot be null or empty (e.g., attribute names and values cannotbe empty strings), and, and within a single item, the names of itsattributes may be unique.

Various types may be employed in the data storage system to support theordering of data in sorted indexes. In some embodiments, the datastorage service may support only a small number of types (e.g., stringsand decimal numbers), and all attribute values must have either a scalaror set (multiple value) type. For example, in some embodiments, theservice (and/or the underlying system implementing the service) may onlysupport two scalar data types: strings, and numbers (e.g., decimalnumbers). In such embodiments, a date may be encoded as an integer(e.g., as a Unix epoch timestamp) rather than using a “date” data type.In other embodiments, more, fewer, or different data types may besupported. As noted above, in some embodiments, attribute names mayalways be of data type “string”. In some embodiments, the service(and/or the underlying system) may support multi-valued types that arederived from the supported scalar types, as in the following example:

ScalarType:={N|S}

MultiValuedType:={NS|SS}

In this example, N represents a number, S represents a string, NSrepresents a set of numbers, and SS represents a set of strings. Invarious embodiments, attributes of type “string” may be part of a key orpart of an index, and the maximum size of a string may be limited by thesize of an index key (e.g., 1024 bytes cumulative for a range key or2048 bytes for each hash key) or the item size (e.g., 64 K). In variousembodiments, attributes of type “number” may be used to storeexact-value decimal and integers, and may have variable width encoding.In some embodiments, the amount of space that can be occupied by anattribute of this type may be limited to a pre-determined amount. Notealso that in various embodiments, a number can have a precision P(indicating the maximum number of significant digits that can bestored), and/or a scale S (indicating the number of digits from thedecimal point to the least significant digit). The precision and scaleof a number may in some cases be automatically inferred by the service,and an appropriate storage size may be used for the number. Negativenumbers may be specified using a minus sign at the beginning of thenumber, but a plus sign specified before a number may not be stored, insome embodiments. Leading and/or trailing zeros may or may not bestored, in different embodiments. The following is an example of anumber format that may be employed by the service (and underlyingsystem) described herein:

Number_format=[+|−][{integer}][{.Integer}]

As noted above, an item may include one or more attributes. Eachattribute may have two portions: an attribute name (e.g., an UTF8string) and an attribute value (which may be expressed as a combinationof a type and a value object, where the type describes the type of thevalue). In some embodiments, a single-valued attribute may have a nameand a scalar value, and the type of the attribute may be encoded in theattribute value, as in the following examples:

{“my-string-attr”: {“S”: “my-string-value”}} # String type

{“my-number-attr”: {“N”: 123456.7}} # Number type

In some embodiments, a multi-valued attribute may have a name, and oneor more values of a specified type. In such embodiments, the values maybe unique, as in the following examples:

{“Size”: {“SS”: [“XL”, “L”, “M”, “S”]} # String set

{“SingleDigitPrimes”: {“NS”: [2, 3, 5, 7]} # Number set

In some embodiments, the systems described herein may employ a somewhatlimited indexing and/or query model in order to provide massive (i.e.virtually unlimited) scaling, predictability, and simplicity forusers/subscribers or client applications. For example, in someembodiments, data may be indexed and partitioned (e.g., partitioned inthe underlying database) by a primary key only. In such embodiments, theprimary key to be used for indexing data in a user table may bespecified by the user at the time that the table is created on theuser's behalf. Thereafter, the partitioning of the user's data may behandled by the system, and abstracted from the user. In someembodiments, the primary key used for indexing data may consist of asingle attribute hash key. In other embodiments, the primary key usedfor indexing and/or partitioning data may be a composite key comprisinga hash key component and another component, sometimes referred to hereinas a range key component. As described in more detail herein, in variousembodiments, queries may be supported against indexed attributes, and afull table scan function may be provided (e.g., to supporttroubleshooting). In some embodiments, users may define secondaryindexes for a table based on one or more attributes other than those ofthe primary key, and then may query for items using the indexes theyhave defined. For example, in some embodiments the system may supportthe creation of creating secondary indexes on-the-fly (e.g., using acreateIndex API), and these secondary indexes may scale automaticallybased on storage requirements (e.g., increasing or decreasing datavolume) and/or read/write traffic. In some embodiments, such secondaryindexes may be asynchronously updated as items in the table are updated.

As previously noted, in some embodiments there may be no pre-definedlimit on the number of items in each table maintained by the datastorage service. Conceptually, each item may be thought of as a mappingof attribute names to corresponding attribute values. Using thisanalogy, each entry in the map is an attribute. In various embodimentseach item may include a key attribute, plus zero or more non-keyattributes. In some embodiments, the key attributes must besingle-valued attributes, while non-key attributes may be single-valuedattributes or multi-valued attributes. The following is an example of anitem that has five attributes: a PictureId (of type string), aCustomerId (of type number), a Title (of type string), and Tags (amulti-valued string attribute).

{ “PictureId” : {“S” : “picture123”}, “CustomerId” : {“N” : 1234567},“Title” : {“S” : “sun flower”}, “Tags” : {“SS” : [“flower”, “seattle”]}}

In various embodiments, the service (and/or the underlying system) mayenforce pre-determined size limits on table names, items, attributevalues, primary key values, and/or attribute names. For example, in someembodiments, the total size of all the attribute names and values in anitem (i.e. the row size) may be limited.

FIGS. 3A and 3B illustrate the storing of data in a plurality of tables,according to one embodiment. As illustrated in FIG. 3A and describedabove, each of a plurality of tables (shown as tables 320 a-320 n) maystore a plurality of items. In the illustrated example, table 320 astores items 321 a-321 n, and table 320 n stores items 322 a-322 n. Asillustrated in FIG. 3B, each of the items stored in a table may includea plurality of attributes, and each of the attributes may include anattribute name and a scalar or set type value. In this example, item 321a (stored in table 320 a) includes a numeric “imageID” attribute whosevalue is 1, a numeric “date” attribute whose value is 20100915, a stingattribute named “title” whose value is “flower”, and a string attributenamed “tags” whose value is the set containing the strings “flower”,“jasmine”, and “white”. In this example, item 321 b (which is alsostored in table 320 a) includes a numeric “imageID” attribute whosevalue is 2, a numeric attribute named “ratings” whose value is the setcontaining the numeric values 3, 4, and 2, a sting attribute named“title” whose value is “credenza”, a numeric “width” attribute whosevalue is 1024, and a numeric “depth” attribute whose value is 768. Inthis example, item 321 n (which is also stored in table 320 a) includesa numeric “imageID” attribute whose value is n, a numeric “date”attribute whose value is 20110327, and a string attribute named “tags”whose value is the set containing the strings “france” and“architecture”. Note that even though items 321 a, 321 b, and 321 n areall stored in the same table (table 320 a), they do not all include thesame set of attributes. Instead, each item includes a sparse set ofattributes from among all the attributes that have been specified forthe collection of items stored in table 320 a. In some embodiments,tables such as those described herein may be used to store and managesystem metadata in addition to user data.

The sparsely populated items described above may be further illustratedby the grid representation in Table 1 below. Note that the grid formatof Table 1 below is merely a convenient mechanism for illustrating thefact that various items in a single table may include different subsetsof the item attributes included in the collection of items in the table.It is not meant to imply any particular structure for a table that ismaintained in the non-relational database systems described herein, orfor the items themselves. Therefore, the choice and arrangement of therows and columns of Table 1 below may be considered to be arbitrary andfor illustration purposes only. As described herein, the tablesmaintained by the systems described herein may not have fixed schemas.As such, items may not include placeholders (i.e. empty elements) forattributes that are not included therein, and attributes (and theirvalues) may be added to one or more items without having to add them toall other items.

TABLE 1 Example of sparsely populated item attributes imageID date titleratings tags width depth 1 2010 Sep. 15 flower flower, jasmine, white 2credenza 3, 4, 2 1024 768 . . . n 2011 Mar. 27 France, archi- tecture

In some embodiments, a table maintained by the data storage service onbehalf of a client/user may have a primary key that identifies itsitems. The primary key may be defined over one attribute (and may besingle valued, as described above) or over several attributes (i.e. itmay be a composite primary key, as described above), in variousembodiments. The key attributes may be immutable, may have a fixed type,and may be mandatory for every item, as they uniquely identify an itemwithin a table. In some embodiments, the primary key is the only part ofthe table that is indexed, and the index type may be specified when atable is created. For example, when a table of items is created, anattribute may be designated as the primary key attributes for the table(or two attributes may be designated for a composite primary key). Allitems in the table must include the attribute(s) designated for theprimary key and the data storage service (and/or underlying system) mayensure that the value (or combination of values) for those attributenames is unique for each item in the table. For example, if an attemptis made to add a new item that has the same primary key value as anexisting item, the new item may replace the existing item in the table.

FIG. 4 illustrates three items that may be stored in a table for which anumeric attribute named “imageID” has been designated as the primarykey, according to one embodiment. In this example, item 410 a includesthe imageID attribute (which has a value of 1), and values for at leastthree other attributes (e.g., a date attribute, a title attribute, and atags attribute). Similarly, item 410 b includes the imageID attribute(which has a value of 2), and values for at least three other attributes(e.g., an album attribute, a rating attribute, and a tags attribute). Inthis example, item 410 c includes the imageID attribute (which has avalue of 3), and values for at least three other attributes (e.g., adate attribute, a price attribute, and an author attribute). In thisexample, the items stored in the table may be indexed according to theirprimary key values. In other words, each of these items may be uniquelyidentified by its primary key value alone, and an operation to retrievean item that has been identified by its primary key value may includeretrieving the values of some or all of its other attributes.

As noted above, the data storage service (and/or the underlying system)may create an index based on the primary key. The type of index may bedependent on the whether the table uses a simple primary key or acomposite primary key. For example, the data storage service may indexthe primary key either as a hash index or a hash-and-range index, asfollows:

-   -   Hash—A may be can be a string or a number. Simple primary keys        may have one index value: a hash index, which may be a string or        a number.    -   Range—A range may be a string or a number. A range may allow        table items to be sorted so that data queries can refine results        based on the range. Composite primary keys may contain two        values for the index: a hash index (sometimes referred to herein        as the hash key value) and a range index (sometimes referred to        herein as the range key value).

A simple primary key may be sufficient for data collection andinfrequent scanning of table data (e.g., using the scan API describedbelow). A composite primary key may allow table data to be organizedmore precisely, and may allow the use of the Query API described belowfor more efficient data retrieval. The following address table (Table 2)illustrates the use of a single attribute as the primary key to uniquelyidentify each item in the table.

TABLE 2 uses a simple primary key (string) Primary Key Other AttributesUserID = Jennifer street = 100 Pine, city = Seattle, state = WA UserID =Bob street = 24 Freemont Ave, zip = 95112 UserID = Harold street = 20104N. 4^(th) St., suite = 35, city = Columbus, state = OH

In this example, the primary key, an attribute called UserID, isrequired in every item and its type (“string”) is fixed for every item.However, each item may also include any combination of additionalattributes. The data storage system may in some embodiments beconfigured to ensure that the value of UserID is unique for each item inthe table. As noted above, in some embodiments, attribute values cannotbe null or empty. In such embodiments, an attribute does not exist inthe table until/unless it has a value associated with it. The followingtable (Table 3) designates a numeric attribute (in this case, theImageID) as the primary key by which items in the table may be uniquelyidentified:

TABLE 3 uses a simple primary key (number) Primary Key Other AttributesImageID = 1 ImageLocation = myBucket/img_1.jpg, Date =2009-12-12T10:30:30Z Title = flower Tags = Flower, Jasmine Width = 1024Depth = 768 ImageID = 2 ImageLocation = myBucket/img_2.jpg, Date =2010-09-20T18:40:50Z Ratings = 3, 4, 2 Tags = Work, Seattle, OfficeWidth = 1024 Depth = 768 ImageID = 3 ImageLocation = myBucket/img_3.jpg,Date = 2010-09-23T10:30:30Z Price = 10.25 Tags = Seattle, Grocery, StoreAuthor = Bob Camera = phone ImageID = 4 ImageLocation =myBucket/img_4.jpg, Date = 2010-08-23T10:40:50Z Title = Hawaii Author =Joe Colors = orange, blue, yellow Tags = beach, blanket, ball

In this example, the primary key, ImageID, is required in every item andits type (“number”) is fixed for every item, but each item may includeany combination of other attributes. As in the previous example, thedata storage system may in some embodiments be configured to ensure thatthe value of ImageID is unique for each item in the table. As notedabove, in some embodiments, attribute values cannot be null or empty. Insuch embodiments, an attribute does not exist in the table until/unlessit has a value associated with it.

One embodiment of a method for creating a table to be maintained by adata storage service on behalf of a storage service client isillustrated by the flow diagram in FIG. 5. As illustrated at 510, inthis example, the method may include a component of the system thatimplements the data storage service (e.g., a front end module or anothercomponent of the underlying system) receiving a service request tocreate a table on behalf of a user. The request may specify a name forthe table and a simple or composite primary key for the table. In someembodiments, the request may also include an estimate of the eventualtable size and/or an estimate of the workload (i.e. traffic) to bedirected to the table, and/or a requested capacity or throughputtraffic. In some embodiments, such information (if included in arequest) may be used to determine an initial size for the table and/oran initial number of partitions for the table. In other embodiments,client or subscriber account information (e.g., preferences) orhistorical data for a particular storage service client (e.g., for aparticular user, subscriber or client application) may be used todetermine an initial size and/or number of partitions for a table beingcreated.

As illustrated in this example, the method may include determiningwhether an active table that has the table name specified in the requestalready exists in the system, as in 520. If so, shown as the positiveexit from 520, the method may include returning an error indication, asin 525. If no active table exists with the specified table name, shownas the negative exit from 520, the method may include the systeminitiating creation of a new table (having the specified table name) ina non-relational data store (e.g., a non-relational database or otherstorage structure), as in 530. In some embodiments, the request may beparsed to determine various service options. For example, the requestmay include an indication of one or more user preferences, such as apreferred service request throughput level, or a service requestthroughput level for which a guarantee is requested. In someembodiments, data to be stored in a newly created table may be includedin a request to create the table, while in other embodiments, data to bestored in the table may be included in one or more service requestsreceived by the data storage system subsequent to receiving the requestto create the table. In various embodiments, there may be nopre-determined size limit or schema for the tables that are to bemaintained by the data storage service.

In some embodiments, in response to receiving data to be stored in thetable (through any number of service requests that include data to bestored in the table), the system may be configured to determine whetherthe amount of data to be stored in the table is too much to be stored ina single partition in the system. For example, in some embodiments,while the system may not impose a limit on the number (and/or size) ofitems that can be stored in a table, it may impose a pre-determinedlimit on the number (and/or size) of the items that can be stored ineach partition in the non-relational data store. In some embodiments,user input may indicate whether there is expected to be too much data ortoo much traffic directed to the table to provide reasonable performanceof the system if the table is implemented as a single partition. If so,shown as the positive exit from 540, the method may include the systemcreating two or more partitions in which to store the table data,according to the specified primary key, as in 550. For example, inembodiments in which the primary key is a simple key, a hash of theprimary key value of each of the items may be used to partition thedata. In embodiments in which the primary key is a composite key, thedata may be partitioned first by a hash of the hash key component, andthen by the range key component. For example, if the range key componentrepresents a numeric identifier by which items having the same hash keycomponent value are ordered, the first n items in order of their rangekey component values may be placed in one partition (wherein n is anumber less than the number of items that can be stored in a singlepartition), and the next n items may be placed in another partition, andso on.

If the amount of data to be stored in the table or the traffic to bedirected to the table is not too much for the table to be stored as asingle partition in the system, shown as the negative exit from 540, themethod may include the system creating a single partition in which tostore the table data, as in 560. Thereafter, the system may beconfigured to programmatically (i.e. automatically) manage the table inthe non-relational data store on behalf of the client/user in responseto changes in workload or system conditions, and/or in response toreceiving various service requests from users/subscribers or clientapplications, as in 570. For example, in some embodiments, the systemmay be configured to monitor the state of the system hardware, anychanges in service request throughput, any table size increases (ordecreases), and/or any changes in the frequency or targets of incomingservice requests, and to automatically (e.g., programmatically) scale,re-configure and/or repartition the table as needed or in response to anexplicit service request received from a storage service client.

The data storage service described herein (and/or the underlying system)may provide an application programming interface (API) for requestingvarious operations targeting tables, items, and/or attributes maintainedon behalf of storage service clients. In some embodiments, the service(and/or the underlying system) may provide both control plane APIs anddata plane APIs. For example, the data storage service may provide acollection of APIs that perform any or all of the following operations:

Create or delete a table.

Request the current state of a table or tables, including primary keyand creation information.

-   -   Put (store) an item in a table.

Get (retrieve) one or more items (and/or their attributes) via theprimary key.

Delete an item from a table.

Update the attributes in a single item.

Query for items using a range index and comparison operators.

Scan over an entire table, optionally filtering the items returned usingcomparison operators.

The control plane APIs provided by the data storage service (and/or theunderlying system) may be used to manipulate table-level entities, suchas tables and indexes. These APIs may be called relatively infrequently(when compared to data plane APIs). In some embodiments, the controlplane APIs provided by the service may be used to create tables, deletetables, and/or describe tables. In some embodiments, control plane APIsthat perform updates to table-level entries may invoke asynchronousworkflows to perform a requested operation. Methods that request“description” information (e.g., via a describeTables API) may simplyreturn the current known state of the tables maintained by the serviceon behalf of a client/user.

The data plane APIs provided by the data storage service (and/or theunderlying system) may be used to perform item-level operations, such asstoring, deleting, retrieving, and/or updating items and/or theirattributes, or performing index-based search-type operations acrossmultiple items in a table, such as queries and scans.

The APIs provided by the service described herein may support requestand response parameters encoded in one or more industry-standard orproprietary data exchange formats, in different embodiments. Forexample, in various embodiments, requests and responses may adhere to ahuman-readable (e.g., text-based) data interchange standard, (e.g.,JavaScript Object Notation, or JSON), or may be represented using abinary encoding (which, in some cases, may be more compact than atext-based representation). In various embodiments, the system maysupply default values (e.g., system-wide, user-specific, oraccount-specific default values) for one or more of the input parametersof the APIs described herein.

As noted above, the control plane APIs supported by the service mayinclude APIs that perform updates on tables (e.g., a CreateTable APIand/or a DeleteTable API). In various embodiments, these APIs may invokeasynchronous workflows to perform the requested operation. In addition,the service may support methods that return the current known state(e.g., a DescribeTables API). In some embodiments, a common use modelmay be for a client to request an action (e.g., using a CreateTableAPI), and then to poll on its completion via the correspondingdescription API (e.g., DescribeTables).

In various embodiments, a CreateTable API may be used to create a tablehaving a specified primary index (i.e. a primary key). In someembodiments, in response to receiving a request to create a table onbehalf of a storage service client via this API, the service may trigger(and/or the underlying system implementing the service may invoke) anasynchronous CreateTable workflow that returns immediately (i.e. withoutwaiting for the workflow to be completed). In such embodiments, thesuccess of the workflow may be subsequently determined by checking thestatus of the table via a DescribeTables API. For example, each tablebeing managed by the service on behalf of a client/user may be in one ofthe following table states, and an indication of the state of each tablemay be returned in a response to a DescribeTables request:

Creating—in which the table is being created

Active—in which the table exists

Deleting—in which the table is being deleted

One embodiment of a method for creating a table in response to a requestreceived through a web services API is illustrated by the flow diagramin FIG. 6. As illustrated in this example, the method may include asystem that implements a data storage service receiving a servicerequest to create a table on behalf of a user, as in 610. The requestmay include the name of the table to be created and may specify a simpleor composite primary key for the table. In response to receiving therequest, and if an active table having the specified table name does notalready exist, the system may generate metadata for the table, as in620. The generation of table metadata is illustrated in FIG. 7 anddescribed in detail below, according to one embodiment. After creatingmetadata for the table, the method may include the system invoking anasynchronous CreateTable workflow (e.g., a component of the system mayissue a call to a CreateTable method), as in 630. One embodiment of sucha workflow is illustrated in FIG. 8 and described below. In someembodiments, a response may be returned from the CreateTable workflowimmediately (i.e. prior to the completion of the CreateTable workflow,or in some cases prior to the CreateTable workflow beginning the processof creating the table).

In some embodiments, after invoking the CreateTable workflow, the systemmay continue to do other work, rather than waiting for the completion ofthe CreateTable workflow. For example, the system (or a componentthereof) or an application (on behalf of a user) may be configured toperiodically or occasionally check the status of the new table to see ifit is in the “Active” state, as in 640. In some embodiments, this mayinvolve issuing a service request using the DescribeTables API describedherein. The status of the table may be checked repeatedly until itsstate is “Active”, shown as the feedback loop from the negative exit of640 to the input of 640. Once the table state is “Active”, the tablecreation process may be considered complete, as in 650.

In some embodiments, the input parameters for a CreateTable API mayinclude a TableName (which may be a string comprising the name of thetable to be created), and a KeySchema for this API (which may describethe primary key for the table to be created). In some embodiments, theKeySchema may include an array describing a simple or composite primarykey. For example, a simple primary key may include a single hash key,while a composite key may include a hash and a range key. In oneembodiment, the index type of the primary key may be HASH or RANGE, andeach attribute of the primary key may include a name (which may be astring comprising the name of an attribute) a data type for theattribute value (e.g., N or S), and the attribute value. As previouslynoted, a CreateTable request may be presented in a JSON request formator another suitable format, in different embodiments. The following isan example of a request to create a table with a composite primary indexhaving two attributes: FolderID (a hash index of type string) andDateCreated (a range of dates, each represented as a number).

Example Request Format:

{ CreateTable { “TableName”:“Pictures”, “KeySchema”:[ {“Name”:“FolderID”, “IndexType”:“HASH”, “DataType”:“S” }, { “Name” :“DateCreated”, “IndexType” : “RANGE”, “DataType” : “N” } ] } }

In some embodiments, the output parameters for a CreateTable API mayinclude the TableName (e.g., a string comprising the name of the tablebeing created), a TableStatus (e.g., a string having the value“Creating”), a KeySchema (e.g., an array describing the primary key,which may be a simple hash key or include a range), and a DateCreated(which may be a string or number indicating the date and/or time whenthe table was created). As previously noted, a response to a CreateTablerequest may be presented in a JSON response format or another suitableformat, in different embodiments. In some embodiments, if an attempt ismade to create a table that already exists (e.g., one with the samename, primary key, and/or key schema), an indication of an errorcondition may be returned by the service (e.g., a ResourceInUse errorcondition). The following is an example of a response received from adata storage service corresponding to a CreateTable request.

Example Response Format:

{ “TableName” : “Pictures”, “TableStatus” : “Creating”, “KeySchema” : [{ “Name” = “ImageID”, “IndexType” = HASH, “DataType” = “N” } ],“DateCreated” : “20100101T05:05:05Z” }

As noted above, in response to receiving a request to create a table onbehalf of a storage service client/user (e.g., using a CreateTable API),the data storage service (and/or the underlying system) may in someembodiments generate metadata to be associated with the table and invokean asynchronous CreateTable workflow to create the table. In someembodiments, there may be multiple tables storing and/or maintainingmetadata associated with table creation, and one or more of these tablesmay be updated with when a new table is created. For example, the systemmay maintain any or all of the following tables, in various embodiments:

-   -   Tables Table: This table may maintain a list of every table in        the system, along with the current state of the table (e.g.,        Creating, Active, Deleting, etc). The primary key for this table        may in some embodiments include a SubscriberId attribute (which        may be used to identify the user on whose behalf the table will        be maintained) and a TableName attribute (which may specify the        name of the table that will be created). When an entry is        created for the new table, the table status may be set to        “Creation Pending”, which may indicate that the table has been        accepted for creation, but that a workflow has not yet been        invoked to create the table.    -   Subscribers Table: This table may maintain a count of the total        number of tables being maintained on behalf of a single client        (i.e. user/subscriber or client application), and may also        indicate how many of them are in each of the states Active,        Creating, and/or Deleting. The primary key for this table may in        some embodiments include a SubscriberId attribute, as described        above. In some embodiments, this table may be treated as a        secondary index to the Tables table. The count of the total        number of tables and/or the count of the number of tables in the        Creating state may be incremented in response to the invocation        of a CreateTable workflow.    -   Partitions Table: This table may maintain a list of all        partitions for a particular table, and may indicate their        locations. The primary key for this table may in some        embodiments include a TableId attribute and a PartitionId        attribute.    -   Nodes Table: This table may maintain a list of nodes, and may        indicate the partitions that are hosted on each of them. The        primary key for this table may in some embodiments include a        NodeId attribute. In some embodiments, this table may be treated        as a secondary index to the Partitions table.

One embodiment of a method for generating table metadata for a tablebeing created is illustrated by the flow diagram in FIG. 7. As describedabove, such a method may be invoked by a system that implements a datastorage service in response to receiving a request to create a table onbehalf of a user, where the request specifies a table name and a simpleor composite primary key. The table name may be unique for a given useror across a given subscriber account. As illustrated in this example,once the method is invoked (as in 710), it may include creating a uniquetable identifier for the table, as in 720. For example, a component ofthe system may be configured to create a table identifier that is uniqueacross the entire system. As illustrated in this example, the method mayinclude deciding on the number of partitions that will be created andcreating corresponding partition identifiers, as in 730. For example, acomponent of the system may be configured to apply historical usage data(e.g., for a user/subscriber or client application), an estimation offuture usage provided by a user/subscriber, and/or other criteria todetermine an appropriate number of partitions for the table and tocreate partition identifiers for each partition that are unique acrossthe entire system.

In some embodiments, the method may include creating an entry for thenew table in a Tables table (such as that described above), and settingthe state of the new table to “Creation Pending”, as in 740. The methodmay also include incrementing a count of the total number of tablesbeing maintained in the system and/or a count of the number of tables inthe system that in the Creation Pending state, as in 750. As illustratedin this example, once metadata for the table has been generated, and oneor more metadata tables have been updated to reflect the pendingcreation of the new table, the method may include calling a CreateTableworkflow, as in 760. As illustrated at 810 of FIG. 8, in someembodiments, the table name, table identifier, and/or partitionidentifiers may all be passed to the CreateTable workflow as inputs tothat process. Note that this (and/or any other service requestsdescribed herein) may include an input parameter identifying aparticular subscriber, such as an accountID parameter. In suchembodiments, the value of this input parameter may be passed to anyworkflows invoked in response to receiving the service request (e.g.,the CreateTable workflow).

Note that in other embodiments, metadata for a table maintained by adata storage service on behalf of one or ore storage system clients maybe organized differently than in the example described above. Forexample, in other embodiments, the system may employ more, fewer, ordifferent metadata tables, which may store more or less metadata than inthis example, and/or different metadata of different types than thatdescribed in this example. Note also that in some embodiments, requeststo create tables may be placed in a queue when they are received, andmetadata for those tables may not be generated or stored until some timelater (e.g., when a CreateTable workflow is invoked to perform the tablecreation).

As previously noted, a system that is configured to implement the datastorage service described herein may rely on one or more workflows thatare executed using a simple workflow service. In some embodiments, aCreateTable workflow may allocate one or more partitions for a newtable, create two or more replicas each for the partitions, and updatethe appropriate metadata in response to creating the table. Oneembodiment of such a workflow is illustrated by the flow diagram in FIG.8. The workflow may be intended to be self-healing, in some embodiments.In such embodiments, if the process fails before completion, the wholeworkflow may be rerun one or more times until it succeeds. For example,each of the operations illustrated in FIG. 8 may be retried again andagain in response to a failure. Note that in this example, it is assumedthat the workflow is invoked only after determining that no active tableexists that has the specified table name.

As illustrated in this example, the workflow may include updating thestatus of the table to “Creating” to reflect the fact that a workflow iscurrently working to create the table, as in 820. In some embodiments,the table status may be atomically updated to “Creating”. In suchembodiments, if multiple workflows attempt to perform this same tablecreation operation, only one will succeed, thus allowing the system toavoid a race condition, in this case. The workflow may also includedetermining whether any old partitions exist that include the table namespecified for the new table, as in 830. For example, if a creationoperation specifying this table name has been attempted (and failed) inthe past, there may be remnant partitions remaining in the system thatshould be deleted before proceeding with the rest of the CreateTableworkflow. In some embodiments, the workflow may include queryingmetadata (e.g., the Tables table) for any partitions associated withthis table name. For example, there may be remnants of a previous failedattempt to create a table with this table name in the system, includingmetadata for the table in one or more metadata tables. For eachpartition found, there may be multiple replicas, and each of thesereplicas may be physically deleted from the storage nodes on which theyreside, as in 835.

In no partitions associated with the specified table name are found(e.g., if this table creation operation has not been previouslyattempted and failed), shown as the negative exit from 830, or once suchremnants have been deleted, the workflow may create one or morepartitions for the new table, as in 840. As previously described, insome embodiments, the number of partitions created may be based on userinput, historical data, and/or system-wide, client-specific, orapplication-specific defaults. As illustrated in FIG. 8, creatingpartitions for the new table may include selecting nodes on which tostore multiple replicas of each of the partitions, creating the multiplereplicas, and updating the partition metadata (e.g., updating thePartitions table to include the newly created replicas and to indicatetheir locations). In some embodiments, selecting the nodes on which tostore the replicas may include querying metadata to discover healthynodes on which replicas can be stored, and allocating replicas tovarious ones of the healthy nodes using any of a variety of suitableallocation algorithms. In some embodiments, the system may support twoor more flexible and/or pluggable allocation algorithms, including, butnot limited to, selecting the nodes that have the most available storagespace, selecting the nodes experiencing the lightest workload (e.g., thenodes receiving the fewest service requests), or selecting nodes atrandom (which may minimize a herding effect in which all new partitionsgo to the most lightly loaded nodes).

As illustrated in FIG. 8, the CreateTable workflow may include updatingnode related metadata for the newly created table (e.g., in the Nodestable), as in 850. For example, the workflow may include reading all ofthe node locations of the newly created replicas from the Partitionstable (which was updated in 840), and adding each of the newly createdreplicas to the appropriate entries of the Nodes table. Once the table'spartitions (and their replicas) have been created, and the appropriatemetadata has been updated to reflect the creation of the new table, theworkflow may include updating the status of the newly created table to“Active”, as in 860. In some embodiments, updating the status of thenewly created table to “Active” may include decrementing a count of thenumber of tables that are in the Creating state in the Subscribers tabledescribed above.

As noted above, in some embodiments, if any of the operationsillustrated in FIG. 8 fail, they may be retried up to a pre-determinedmaximum number of attempts. For example, in one embodiment, anyCreateTable workflow step that is unsuccessful may be retried up to tentimes, and may employ an exponential back-off between attempts. In someembodiments, if the workflow step does is not successfully completedafter the maximum number of attempts, the state of the table beingcreated may be reset to Creation Pending to indicate that no workflow iscurrently working on creating the table. In such cases, the system mayor may not perform cleanup of any residual replicas created during theunsuccessful attempts. For example, in some embodiments, this cleanupmay be left for a subsequent CreateTable workflow. In some embodiments,a sweeper workflow may run periodically (e.g., once every 30 minutes),and may scan the Tables table to determine if there are any tablescurrently in state Creation Pending. If so, and if the state of thistable has not been updated since the last time the Tables table wasscanned by the sweeper workflow, the sweeper workflow may assume thatthe creation of this table failed, and may invoke a new CreateTableworkflow in an attempt to create the table.

The use of the CreateTable API may be illustrated by way of thefollowing examples (i.e. by the pseudo code below). In the firstexample, a request is made to create a table named “Merchandise” inwhich the primary key is a hash value “ID” and in which each ID value inthe table must be a number:

CreateTable ( ‘Merchandise’, array ( ‘HashKeyElement’ => array (‘AttributeName’ => ‘ID’, ‘AttributeType’ => NUMBER )));

In the second example, a request is made to create a table named“Merchandise” in which the primary key is a hash-with-range key (i.e. acomposite key). In this example, the primary key includes a hash value“ID” (where each ID in the table must be a number), and also includes arange added to the primary key of “song” (where each song is a string).In this example, after requesting that the table be created, using theCreateTable API, a DescribeTables API is repeatedly invoked to poll theserver until the new table is created and active.

CreateTable (‘Merchandise’, array ( ‘HashKeyElement’ => array (‘AttributeName’ => ‘ID’, ‘AttributeType’ => NUMBER ), ‘RangeKeyElement’=> array ( ‘AttributeName’ => ‘song’, ‘AttributeType’ => STRING ) )); //Poll and sleep until the table is ready, do { sleep(3); status =DescribeTables (array ( ‘TableNames’ => ‘Merchandise’ )); status =status−>body−>Tables−>to_array( ); } while (status[0][‘TableStatus’] !==‘ACTIVE’);

In some embodiments, a storage service client (e.g., a user, subscriber,or client application with access to the service) may be able to createmultiple tables. In some such embodiments, the system may impose apre-determined limit on the number of tables that a client can create.Such a limit may protect the system and/or the client/user from thepossibility that a run-away process creates an unintentionally largenumber of tables. In some embodiments in which such a limit is employed,it may be overridden by a system administrator or other privileged user(e.g., via an admin console, as described above). In some embodiments,all tables may be owned by a root user (e.g., a table owner or otherprivileged user), and this root user may be able to assign API levelpermissions to various tables to enable and/or restrict operations onthose table by other users (e.g., sub-users). For example, in someembodiments, an individual user may be defined by a combination of aroot user identifier and a sub-user identifier, as follows:user={root|sub-user}. In some embodiments, access control filters may bedefined at the item level and/or at the attribute level in addition to,or instead of, at the table level.

In various embodiments, a DeleteTable API may be used to delete a tableand all of its indexes. In some embodiments, if a table that is thetarget of a DeleteTable API is in a Creating state when the request todelete to that table is received on behalf of a storage service client,the service may return an indication of an error (e.g., a 400“ResourceInUse” error indication). If the table is in an Active statewhen the request is received, the service may trigger (and/or theunderlying system implementing the service may invoke) an asynchronousDeleteTable workflow that returns immediately (i.e. without waiting forthe workflow to be completed). In such embodiments, the success of theworkflow may be subsequently determined by checking the status of thetable via a DescribeTables API. For example, if the indication of thestate of the table that is returned in a response to a DescribeTablesrequest is “Deleting” then the delete operation may be in progress. Insome embodiments, no error indication would be returned in this case.Once the delete process is complete, the response to a DescribeTablesrequest may no longer include an entry for the deleted table.

In some embodiments, the input parameters for a DeleteTable API mayinclude a TableName (which may be a string comprising the name of thetable to be deleted). In some embodiments, the output parameters for aDeleteTable API may include the TableName (e.g., a string comprising thename of the table being deleted), a TableStatus (e.g., a string havingthe value “Deleting”), a KeySchema (e.g., an array describing theprimary key), and a DateCreated (which may be a string or numberindicating the date and/or time when the table was created). Asdescribed above, in some embodiments, the KeySchema may include an arraydescribing a simple or composite primary key. For example, a simpleprimary key may include a single hash key, while a composite key mayinclude a hash and a range key. In one embodiment, the index type of theprimary key may be HASH or RANGE, and each attribute of the primary keymay include a name (which may be a string comprising the name of anattribute) a data type for the attribute value (e.g., N or S), and theattribute value. As previously noted, a DeleteTable request and/orresponse may be presented in a JSON request/response format or anothersuitable format, in different embodiments. Examples of a request to adata storage service and a response received from a data storage servicecorresponding to a DeleteTable API are found below, according to oneembodiment.

Example Request Format:

{ DeleteTable{ “TableName”:“Pictures” } }Example Response Format:

{ “TableName” : “Pictures”, “TableStatus” : “Deleting”, “KeySchema” : [{ “Name” = “ImageID”, “IndexType” = HASH, “DataType” = “N” } ],“DateCreated” : “20100101T05:05:05Z” }

In various embodiments, a DescribeTables API may be used to enumerate(e.g., list) information about tables belonging to a given storageservice client. For example, in response to receiving a request onbehalf of a user to describe tables belonging to that user, the datastorage system may return primary key information and/or the status ofany tables specified in the request or (if none are specified) alltables that belong to that user. In some embodiments, the inputparameters for a DescribeTables API may include a TableNames parameter(which may be a list of strings comprising the names of the tables to bedescribed), and/or a LastTableName parameter (which may be a stringcomprising the name of the table from which to continue listing tableinformation if a pre-determined limit on the number of tables that canbe included in a response has been exceeded). For example, in someembodiments, if the number of tables to be returned exceeds apre-determined limit, the query may be terminated early (i.e. withoutdescribing all of the tables targeted by the request) and the name ofthe last table considered by the query may be returned. In suchembodiments, this last table name may be subsequently used to continuethe query from that point onward. In some embodiments, if the TableNamesparameter is empty (or otherwise unspecified), all tables belonging tothe user may be described in one or more responses to a DescribeTablesrequest.

In some embodiments, the output parameters for a DescribeTables API mayinclude a Tables parameter (which may include a list of tables owner bya given user, along with information about each of those tables) and/ora LastTableName parameter (which may indicate the name of the last tableabout which information was returned, if the number of tables exceedsthe maximum number of tables about which information can be returned ina response to a single DescribeTables call). In some embodiments, foreach table listed in the response, any or all of the followinginformation may be included: the TableName (e.g., a string comprisingthe name of the table), a TableStatus (e.g., a string having a value of“Creating”, “Active” or “Deleting”), a KeySchema (e.g., an arraydescribing the primary key), and a DateCreated (which may be a string ornumber indicating the date and/or time when the table was created). Asdescribed above, in some embodiments, the KeySchema may include an arraydescribing a simple or composite primary key. For example, a simpleprimary key may include a single hash key, while a composite key mayinclude a hash and a range key. In one embodiment, the index type of theprimary key may be HASH or RANGE, and each attribute of the primary keymay include a name (which may be a string comprising the name of anattribute) a data type for the attribute value (e.g., N or S), and theattribute value. In some embodiments, if one or more of the tablesspecified in a DescribeTables request does not exist, an errorindication (e.g., a 400 “ResourceNotFound” error indication) may bereturned in response to the request. As with other APIs provided by thedata storage service, a DescribeTables request and/or response may bepresented in a JSON request/response format or another suitable format,in different embodiments. Examples of a request to a data storageservice and a response received from a data storage servicecorresponding to a DescribeTables API are found below, according to oneembodiment.

Example Request Format:

{ DescribeTables { “TableNames”: [ ] } }Example Response Format:

{ “Tables” : [{ “TableName” : “Pictures”, “TableStatus” : “Deleting”,“KeySchema” : [ { “Name” = “ImageID”, “IndexType” = HASH, “DataType” =“N” } ], “DateCreated” : “20100101T05:05:05Z”}] }

As noted above, the data storage service (and/or underlying system)described herein may provide various data plane APIs for performingitem-level operations, such as a PutItem API, a GetItem API, aDeleteItem API, and/or an UpdateItem API, as well as one or moreindex-based seek/traversal operations across multiple items in a table,such as a Query API and/or a Scan API.

In some embodiments, a PutItem API may be used to insert a new (single)item in a table. In some embodiments, this API may be used to perform aconditional put operation. For example, it may be used to insert an itemin a table if it does not already exist in that table (according to thespecified value of the primary key), or to replace an existing singleitem in a table if it has certain attribute values (e.g., a specifiedprimary key). More specifically, in some embodiments this API may beused to completely replace all of the attributes of an existing item(except the primary key) with new attributes to create a “new” item. Insuch embodiments, the data storage system may guarantee that thisreplacement operation is performed atomically. In other words, thesystem may perform the replacement operation in a way that guaranteesthat the item is observable only with all of its new attributes or withall of its previous attributes, and is not observable in an interimstate (e.g., with a mix of previous and new attributes). In someembodiments, the PutItem API may be an idempotent API if a conditionalput operation is not specified. In other words, a request made using anon-conditional form of the PutItem API may insert a specified new itemin a table exactly once, even if it is called multiple times with thesame input parameter values.

In some embodiments, the input parameters for a PutItem API may includea TableName (which may be a string comprising the name of the table inwhich to insert or replace an item), an Item parameter (which may mapone or more attribute names to respective attribute values), an Expectedparameter (which may specify a mapping of attribute names to respectiveattribute values for a conditional Put), and/or a ReturnValues parameter(which may be a string indicating which, if any, values should bereturned as a result of the operation, e.g. “None”, “All_Old”, or“All_New”). In some embodiments, if a ReturnValues parameter value of“None” is specified, there may be no return value for this API. If aReturnValues parameter value of “All_Old” is specified, this API mayreturn the previous contents of an item that was overwritten by thePutItem operation. If a ReturnValues parameter value of “All_New” isspecified, this API may return the contents of the item following thePutItem operation. Note that in some embodiments, the mapping includedin the Item parameter must contain the primary key attribute(s) asdefined for the specified table. In some embodiments, each attributeincluded in the Expected parameter may include an ExpectedAttributeValue(which may be a string having the value “Exists” or “Value”), anAttributeValue (which may indicate the value of the attribute to be usedin the evaluation of a condition, or may have an empty or null value),and/or an Exists parameter (which may indicate that the condition to beevaluated is whether an attribute included in the Expected parameter iscurrently specified for an existing item). In this example, ifExpectedAttributeValue is set to “Value”, a value must supplied forAttributeValue, while if ExpectedAttributeValue is set to “Exists”, theAttributeValue should be null or empty. If a condition specified in arequest via the PutItem API is not met (e.g., if the expected value ofone or more attributes does not match what is stored in the table), anerror indication (e.g., ConditionalCheckFailed) may be returned by thedata storage system.

A PutItem request may be presented in a JSON request format or anothersuitable format, in different embodiments. The following is an exampleof a PutItem request that stores an item in the table only under thecondition that the item does not already contain a populated “Tags”field. In essence, this example illustrates a put operation withPut-If-Absent semantics.

Example Request Format:

{ PutItem{ “TableName” : “Pictures”, “Item” : { “PictureId” : {“S” :“pic123”}, “Title” : {“S” :“Sun Flower”}, “Tags” : {“SS” : [“Flower”,“Sun”]} } “Expected” : { “Tags” : { “Exists” : false}}, } “ReturnValues”: “All_Old” } }

In some embodiments, the output parameters for a PutItem API may includean Attributes parameter (which may map one or more attribute names totheir respective values). In the example above, this mapping may only bereturned when the input parameter ReturnValues is not “None”. Thefollowing is an example of a response received from a data storageservice corresponding to a PutItem request in which ReturnValues isspecified as “All_Old”.

Example Response Format:

{ “Attributes” : { “PictureId” : {“S” : “pic123”}, “Title” : {“S” :“SunFlower”} } }

The use of the PutItem API may be further illustrated by way of thefollowing examples (i.e. by the pseudo code below). In the firstexample, a request is made to add a new item to a table named“my-table2”, for which the primary key is a hash value “ID”. In thisexample, the item includes an ID value (which is a number) and valuesfor the additional attributes Category, Subcategory, Color, and Size(each of which specifies one or more strings).

PutItem (‘my-table2’, array ( ‘ID’ => array (NUMBER => 1), // PrimaryKey ‘Category’ => array (STRING => ‘Clothes’), ‘Subcategory’ => array(STRING => ‘Sweater’), ‘Color’ => array (STRING => ‘Blue’), ‘Size’ =>array (ARRAY_OF_STRINGS => array (‘Medium’, ‘Large’)), ));

In the second example, a request is made to replace an existing itemusing the PutItem API. In this example, a request is made to replace theexisting item (an item having a primary key value ID=1) with an itemthat has new attributes. Note that by setting the ReturnValues parameterto “All_Old” this request specifies that the old attributes of the itemshould be returned.

PutItem (‘my-table2’, array ( ‘ID’ => array (NUMBER => 1), // PrimaryKey ‘Category’ => array (STRING => ‘Tools’), ‘Subcategory’ => array(STRING => ‘Shovel’), ), array ( ‘ReturnValues’ => All_Old));

In various embodiments, a DeleteItem API may be used to delete a singleitem in a table, where the item is identified by its primary key. Insome embodiments, this API may be used to perform a conditional deleteoperation. For example, it may be used to delete an item if it exists,or if it has certain attribute values (e.g., particular attribute valuesother than the specified primary key). In some embodiments, theDeleteItem API may be an idempotent API if a conditional put operationis not specified. In other words, a request made using a non-conditionalform of the DeleteItem API may cause the system to delete a specifiednew item in a table exactly once, even if it is called multiple timeswith the same input parameter values. In these and other embodiments,attempting to delete a non-existent item may not result in an errorcondition, and may not cause an error indication to be returned.

In some embodiments, the input parameters for a DeleteItem API mayinclude a TableName (which may be a string comprising the name of thetable from which to delete an item), a Key (which may specify thesimple/single or composite primary key that identifies the item to bedeleted), an Expected parameter (which may specify a mapping ofattribute names to respective attribute values for a conditionaldelete), and/or ReturnValues (which may be a string indicating which, ifany, values should be returned as a result of the operation, e.g.“None”, “All_Old”). In some embodiments, if a ReturnValues parametervalue of “None” is specified, there may be no return value for this API.If a ReturnValues parameter value of “All_Old” is specified, this APImay return the contents of the item that was deleted by this operation.For example, when “All_Old” is specified, the output parameters for thisAPI may include an Attributes parameter (which may comprise a mappingbetween the attribute names and their respective values for all of theattributes of the deleted item). In some embodiments, each attributeincluded in the Expected parameter may include an ExpectedAttributeValue(which may be a string having the value “Exists” or “Value”), anAttributeValue (which may indicate the value of the attribute or mayhave an empty or null value), and/or an Exists parameter (which mayindicate that the condition to be evaluated is whether an attributeincluded in the Expected parameter is currently specified for anexisting item). If a condition specified in a request via the DeleteItemAPI is not met (e.g., if the expected value of one or more attributesdoes not match what is stored in the table), an error indication (e.g.,ConditionalCheckFailed) may be returned by the data storage system. Insome embodiments, a DeleteItem request and/or response may be presentedin a JSON request/response format or another suitable format, indifferent embodiments. Examples of a request to delete an item and aresponse received from a data storage service corresponding to aDeleteItem API are found below, according to one embodiment.

Example Request Format:

{ DeleteItem:{ “TableName” : “Pictures”, “Key”:[1, “picture-id”],“Expected” : { “Title” : {“AttributeValue” :{“S”:“flower”}} } } }Example Response Format:

{ “Attributes” : { “CustomerId” : {“N” : 1}, “PictureId” : {“S” :“picture-id”}, “Title” : {“S”:“flower”} } }

Note that in the example illustrated above, the request did not specifya ReturnValues parameter value, but the old attribute values werereturned. This illustrates an embodiment in which the default value forthe ReturnValues parameter is “All_Old”. In other embodiments, thedefault value of this parameter may be a different value (e.g.,“All_New”, or “None”), or there may not be a default value for thisparameter (i.e. it may be a mandatory input parameter).

In various embodiments, a GetItems API may be used to retrieve one ormore items (i.e. to return one or more attributes of those item), giventheir primary keys. In some embodiments, the number of items that can beretrieved in response to a single GetItems request may be limited and/orthe items retrieved must all be stored in the same table. For example,in one embodiment, attributes for a maximum of eight items may bereturned in response to a single GetItems request. In some embodiments,multiple items may be retrieved from a table in parallel, which mayminimize latency. The data storage service (and/or the underlyingsystem) may support projection and/or consistent reads (without alatency penalty), in various embodiments. In some embodiments, thesystem may support an eventual consistency model by default, which mayresult in higher throughput for servicing requests. In some embodimentsin which multiple items are requested in a single GetItems request,items that do not exist in the targeted table will not be returned. Inthis case, there may or may not be any error messages returned toindicate that one or more of the requested items were not returned.

In some embodiments, the input parameters for a GetItems API may includea TableName (which may be a string comprising the name of the table fromwhich to delete an item), a Keys parameter (which may specify a list ofthe simple/single or composite primary keys that identify the items tobe retrieved), an AttributesToGet parameter (which may be an array ofattribute names as strings), and/or a ConsistentRead parameter (whichmay be a Boolean value indicating whether a consistent read will beissued). In some embodiments, if no attribute names are specified, thenall attribute values that have been defined for the identified items maybe returned. In some embodiments, if values for any of the specifiedattributes are not found, the corresponding attribute name will notappear in the result. In some embodiments, if the ConsistentReadparameter is set to true, a consistent read operation will be issued.Otherwise, an eventually consistent read operation will be performed.Note that in some embodiments, strictly consistent reads (e.g., thosefor which the value of a ConsistentRead parameter is true) may bedirected to the master for a given replica group, while reads performedwith eventual consistency may be directed to any of the replicas of agiven replica group. As previously noted, the number of items that canbe retrieved in response to a single GetItems request may be limited toa pre-determined number, in some embodiments. The output parameters fora GetItems API may include an Items parameter, which may be an array ofitems, each of which comprises a map of the requested attributes andtheir values (if any are specified, i.e. non-empty, for the item). Notethat in some embodiments the items in the array may not be ordered inany particular way. In such embodiments, including the primary key inthe list of requested attributes may provide a way to identify theattributes that correspond to each retrieved item and/or to determinewhich of the requested items were (and/or were not) found and retrieved.In some embodiments, there may be no error indications definedspecifically for this API, although one or more of the error indicatorslisted in Table 9 and described herein may apply. Examples of a requestto retrieve several items using a GetItems API and a response receivedfrom a data storage service corresponding that request are found below,according to one embodiment.

Example Request Format:

{ GetItems { “TableName” : “Pictures”, “Keys” : [[“image123”],[“image456”], [“image789”]], “AttributesToGet” : [“ImageId”, “Title”,“Tags”], “ConsistentRead” : true }Example Response Format:

{  “Items” : [ {“ImageId” : {“S”: “image123”}, “Title”: {“S”: “sunflower”}, “Tags”: {“SS”: [“flower”]}}, {“ImageId” : {“S” :“image456”},“Title” : {“S” : “jasmine flower”}, “Tags”: {“SS”: [“flower”,“jasmine”]}}  ] }

In various embodiments, an UpdateItem API may be provided by the datastorage service (and/or the underlying system). This API may be used toinsert an item if it does not already exist, or to manipulate anexisting item at the attribute level (e.g., to modify the values of oneor more of its attributes). For example, updating an item may includeinserting, replacing, and/or deleting various attributes of an existingitem. In some embodiments, updating an item may include atomicallyincrementing or decrementing the value of an attribute having a numbertype. While the PutItem API described above may be used to replace allof the attribute values of an existing item, the UpdateItem APIdescribed herein may provide a more granular replacement operation. Inother words, this API may be used to modify a subset of the attributevalues of an existing item, and/or to modify the set of attributes thatare defined for an existing item.

One embodiment of a method for updating an item in response to a requestto do so is illustrated by the flow diagram in FIG. 9. As illustrated at910, in this example, the method may include receiving a service requestto update an item in a table in a non-relational database (e.g., a tablemaintained on behalf of a data storage service client). As in previousexamples, an UpdateItem request may include a table name and a primarykey (which may collectively identify the item that is the target of theupdate request), and one or more other input parameter values indicatingthe update(s) being requested. If the request indicates that an itemattribute should be added to an item, as in 920, the attribute includedin the request may be added to the item and may be assigned a value thatis also included in the request, as in 925. For example, in response toan UpdateItem request that includes a PUT action for a particularattribute name that does not already exist in the item, the attributename-value pair corresponding to the PUT action may be added to theitem. Similarly, in response to an UpdateItem request that includes anADD action for a scalar numeric attribute or a set type attribute thatdoes not already exist in the item, the attribute name-value paircorresponding to the ADD action may be added to the item.

As illustrated in this example, if the request indicates that the valueof an item attribute should be replaced in an item, as in 930, the valueof an attribute that is included in the request may be replaced by avalue that is also included in the request, as in 935. For example, inresponse to an UpdateItem request that includes a PUT action for aparticular attribute name that already exists in the item, the value ofthat attribute may be updated with a value that was specified in theattribute name-value pair associated with the PUT action in the request.

As illustrated in FIG. 9, if the request indicates that an itemattribute should be removed from an item, as in 940, that attribute andits value(s) may be removed from the item, as in 945. For example, inresponse to an UpdateItem request that includes a DELETE action for ascalar type attribute that exists in the item, that attribute and itsvalue may be removed from the item. Similarly, in response to anUpdateItem request that includes a DELETE action for a set typeattribute that exists in the item, where the request does not specifyany of the values in the attribute's set, the attribute and its entireset of values may be removed from the item.

As illustrated in this example, if the request indicates that one ormore values should be added to or removed from a set of values for anitem attribute, as in 950, the specified value(s) of the attribute thatis included in the request may be added or removed from the set, as in955. For example, in response to an UpdateItem request that includes anADD action for a set type attribute name that already exists in theitem, one or more values specified in the attribute name-value pairassociated with the ADD action in the request may be added to the set ofvalues for the attribute in the item. Conversely, in response to anUpdateItem request that includes a DELETE action for a set typeattribute name that already exists in the item, one or more valuesspecified in the attribute name-value pair associated with the DELETEaction in the request may be removed from the set of values for theattribute in the item.

If the request indicates that the value of an attribute in an itemshould be incremented or decremented, as in 960, the value of theattribute that is included in the request may be atomically incrementedor decremented by an amount that is also included in the request, as in965. For example, in response to an UpdateItem request that includes anADD action for a scalar, numeric attribute name that already exists inthe item, the value of that attribute may be atomically incremented byan amount specified in the request (e.g., if the specified amount is apositive number) or atomically decremented by an amount specified in therequest (e.g., if the specified amount is a negative number). In otherembodiments, the value of a numeric attribute may always be incrementedor decremented by a default amount, or may be incremented or decrementedby a default amount if no amount by which to increment or decrement thevalue is specified in the request.

As illustrated at 970 in FIG. 9, once any valid updates specified in theUpdateItem request have been performed, the method may be complete.However, if any of the specified updates were invalid (e.g., if anyinput parameters were missing or their values were of the wrong type,etc.), the method may include returning one or more error indications.In some embodiments, any valid updates specified in the request may beperformed, even if other updates specified in the request are invalid.In other embodiments, if any of the specified updates are invalid, noneof the updates will be performed. As noted above, a single UpdateItemservice request may specify multiple updates to be applied to variousattributes of a single item, in some embodiments. Therefore, each of theupdate operations illustrated in FIG. 9 (e.g., 925, 935, 945, 955, 965)may be performed multiple times if two of more updates of thecorresponding type are specified in a single service request. Inaddition, a single request may indicate that different types of updatesshould be performed on respective item attributes. Therefore, multipleones of the update operations illustrated in FIG. 9 (e.g., 925, 935,945, 955, 965) may be performed in response to a single UpdateItemrequest. This is illustrated in FIG. 9 by the feedback from 925 to 930,from 935 to 940, from 945 to 950, and from 955 to 960.

In various embodiments, UpdateItem API provided by the data storageservice (and/or the underlying system) may perform a conditional update.In such embodiments, this API may be used to conditionally insert anitem (e.g., to create an item if it does not already exist), or toconditionally replace (i.e. update) an item (e.g., only if itsattributes match any specified expected values). Updating an item mayinclude inserting, updating, and/or deleting various attributes of anexisting item. In some embodiments, the data storage system mayoptionally return the old attribute values for an item that isreplaced/updated using this API.

In some embodiments, the input parameters for an UpdateItem API mayinclude a TableName (which may be a string comprising the name of thetable in which the item to be updated is stored or in which an item isto be conditionally inserted), a Key parameter (which may specify asimple/single or composite primary key that identifies the item to beconditionally updated or inserted), an AttributeUpdates parameter (whichmay be an array mapping each of one or more specified attribute names toa respective AttributeUpdate structure), an Expected parameter (whichmay specify a mapping of attribute names to respective attribute valuesfor a conditional put), and/or a ReturnValues parameter (which may be astring indicating which, if any, values should be returned as a resultof the operation, e.g. “None”, “All_Old”, “Update_Old”, “All_New”, or“Updated_New”).

Each AttributeUpdate structure may include an AttributeValue parameter(which may specify the updated value for the corresponding attribute),and an Action parameter (which may be a string specifying the action tobe taken, e.g., “PUT”, “ADD”, or “DELETE”). The ADD action, whensupported, may allow numerical attribute values to be atomicallyincremented or decremented by a specified amount. Note that because arespective Action parameter value may be specified for each attribute tobe modified, a single UpdateItem operation may be used to applydifferent actions to each of the attributes targeted by an UpdateItemrequest. For example, in response to a single UpdateItem request, thedata storage system may delete one or more attribute values of aspecified item, increment or decrement one or more other attributevalues of the specified item, and/or replace one or more other attributevalues with a specified new value. In some embodiments, the defaultvalue of the Action parameter (e.g., if none is specified) may be “PUT”.Note that since every item must have an immutable primary key, theattributes that are part of the key cannot be modified or deleted usingthe UpdateItem API. In other words, the AttributeUpdates parametercannot include a reference to any primary key attributes. Note also thatthe AttributeValue parameter may be optional when the specified Actionparameter value is “DELETE”.

In some embodiments, each attribute included in the Expected parametermay include an ExpectedAttributeValue (which may be a string having thevalue “Exists” or “Value”), an AttributeValue (which may indicate thevalue of the attribute or may have an empty or null value), and/or anExists parameter (which may indicate that the condition to be evaluatedis whether an attribute included in the Expected parameter is currentlyspecified for an existing item). If a condition specified in a requestvia the UpdateItem API is not met (e.g., if the expected value of one ormore attributes does not match what is stored in the table), an errorindication (e.g., ConditionalCheckFailed) may be returned by the datastorage. In some embodiments, if a ReturnValues parameter value of“None” is specified, there may be no return value for this API. If aReturnValues parameter value of “All_Old” is specified, this API mayreturn the contents (i.e. all attribute values) of the item that wastargeted by the UpdateItem operation prior to the performance of theUpdateItem operation. If a ReturnValues parameter value of “Update_Old”is specified, only the previous value(s) of any updated attribute(s) maybe returned (rather than all attribute values). If a ReturnValuesparameter value of “All_New” is specified, all the attributes of the newversion of the targeted item may be returned (i.e. all of the attributevalues for the item following the performance of the UpdateItemoperation). If a ReturnValues parameter value of “Updated_New” isspecified, only the new value(s) of any updated attribute(s) may bereturned (rather than all attribute values).

One embodiment of a method for updating an item using an API thatsupports conditional updates and/or multiple output options isillustrated by the flow diagram in FIG. 10. As illustrated in thisexample, the method may include receiving a service request to update anitem in a table in a non-relational database (e.g., a table maintainedon behalf of a data storage service client). As in previous examples, anUpdateItem request may include a table name and a primary key (which maycollectively identify the item that is the target of the updaterequest), and one or more other input parameter values indicating theupdate(s) being requested. If the update request is not conditional onany attributed values in the item, shown as the negative exit from 1020,the update(s) specified in the request may be performed, as in 1050.However, if the update request is conditional on one or more attributevalues in the item matching corresponding values specified in therequest (e.g., example, if the inputs to the UpdateItem request includean Expected structure specifying one or more conditions to be met),shown as the positive exit from 1020, the method may include determiningwhether each of the specified conditions is met.

As illustrated in this example, each of the specified conditions may beevaluated (as in 1030) prior to performing the updates specified in therequest. If a given condition is met (shown as the positive exit from1030), but there are additional conditions specified for the request(shown as the positive exit from 1040), the additional conditions may beevaluated (shown as the feedback from 1040 to 1030). If a givencondition is met (shown as the positive exit from 1030), and there areno additional conditions specified for the request (shown as thenegative exit from 1040), the requested update may be performed, as in1050. If any of the specified conditions is not met, shown as thenegative exit from 1030, the requested update(s) may not be performed.

As illustrated in this example, if the service request specifies thatthe pre-update and/or post-update values of the item's attributes shouldbe output, shown as the positive exit from 1060, the method may includereturning the pre-update and/or post-update attribute values of theitem, as in 1070, and the update item operation may be complete, as in1080. For example, if the ReturnValues parameter of an UpdateItemrequest is set to “All_Old”, “Update_Old”, “All_New”, or “Updated_New”,the corresponding old and/or new attribute values may be returned inresponse to completing the item updating process. If the ReturnValuesparameter is set to “None”, or is not specified for the request, noattributed values may be returned. Note that if any of the specifiedconditions were not met, the response may include one or more errorindications, such as those described herein, whether or not any of theold and/or new attribute values are returned in the response. Theresponses to the specification of each of the possible Action parametervalues on a corresponding attribute value are summarized in the tablesbelow, according to one embodiment.

TABLE 4 Update actions targeting existing items If specified Ifspecified attribute is a If specified attribute does Action attribute isScalar Set not exist PUT replace old attribute replace old attribute addthe specified attribute value with new values with new values and itsspecified value to value the item DELETE delete attribute (and If novalue supplied, no action taken its old value) delete the attribute (andall old values in the set). If one or more values is supplied, thesevalues are removed from the set. ADD atomically add the add a newelement to the same as PUT action for specified positive or existing setscalar number types and for negative value to set types existing value

TABLE 5 Update actions targeting items that do not exist Action EffectPUT create new item with specified primary key; add specifiedattribute(s) and their value(s) DELETE no action taken ADD create newitem with specified primary key; same action as PUT for scalar numbertypes and for set types

Note that in some embodiments it may be an error to supply an attributevalue for a delete type update of a scalar attribute. In someembodiments it may be an error to supply an empty set for a delete typeupdate of a set type attribute. In some embodiments the type of thesupplied value(s) for a delete type update of a set type attributeand/or an add type update of a set type attribute must match theexisting value type. As described above, the ADD action may only bevalid for scalar attributes of type number, or for set type attributes,and may be invalid for scalar string types.

As shown in the tables above, when an item targeted by an UpdateItemrequest does not exist and the update operation is carried out with atleast one PUT or ADD Action parameter value, an item may be created, insome embodiments. However, if an UpdateItem operation targets anon-existent item and specifies only DELETE actions, no new item will becreated.

As with other APIs provided by the data storage service, an UpdateItemrequest and/or response may be presented in a JSON request/responseformat or another suitable format, in different embodiments. Examples ofa request to a data storage service and a response received from a datastorage service corresponding to an UpdateItem API are found below,according to one embodiment.

Example Request Format:

{  UpdateItem { “TableName” : “Pictures”, “Key”:[1,2009-12-12T10:30:30Z], “AttributeUpdates” : { “Title” :{“AttributeValue” : {“S” :“Sun Flower”}, “Action” : “PUT”} “Tags” :{“AttributeValue” : {“S” : [“Flower”, “Sun”]}, “Action” : “ADD”}  },“Expected” : {  “Title” : {“AttributeValue” : {“S”:“flower”}}, “Rating”: {“Exists” : false} }, “ReturnValues” : “UPDATED_NEW”  } }Example Response Format:

{ ″Attributes″ : { ″Title″ : {″S″:″Sun Flower″} ″Tags″ : {″S″ :″Flower″, “Sun”}, } }

In this example, the specified updates were conditional on thenon-existence of a Ratings attribute, and on the value of the Titleattribute being “flower”. In response to determining that both of theseconditions evaluated true, the specified updates were made to the Titleand Tags attributes. Note that in this example, the UpdateItem requestincluded a ReturnValues parameter set to Updated_New. Therefore, theresponse included only the new values defined for the attributestargeted by the specified update operations (i.e. the new values for the“Title” attribute, and the “Tags” attribute).

As previously noted, in embodiments in which the primary key is a simplekey, the item in a table being maintained on behalf of a storage serviceclient may partitioned using a hash of the primary key value of each ofthe items, while in embodiments in which the primary key is a compositekey, the data may be partitioned first by a hash of the hash keycomponent, and then by the range key component. FIG. 11 illustrates oneembodiment of a method for partitioning table data using simple and/orcomposite keys, according to one embodiment. As illustrated at 1110, inthis example, the method may include a data storage service (or acomponent of the underlying system that implements a data store, such asa storage node instance or administrative component) initiating thepartitioning of a table maintained in a non-relational data store onbehalf of a storage service client.

If multiple items in the table share a hash key attribute value, shownas the positive exit from 1120, the method may include the data storedividing the items in the table that have a given hash key attributevalue into two or more partitions (e.g., database partitions) dependentfirst on a hash of their range key attribute values, and then on theirrange key attribute values, as in 1140. In other words, if the primarykey for the table is a composite key that includes hash key componentwhose values may be used to identify a group of items and a range keycomponent whose values may be used to order items having the same hashkey attribute values and uniquely identify each of those items, both thehash key attribute value and the range key attribute value may be usedto partition the items in the table. For example, for a group of itemsthat have the same hash key attribute value, the first n items in thegroup (when ordered by their respective range key attribute values) maybe assigned to one partition, the next m items in the group may beassigned to a second partition, and so on. Note that in someembodiments, each partition may include a portion of the items sharingone hash key attribute value and may also include other items havingother hash key attribute values.

If none of the items in the table share a hash key attribute value,shown as the negative exit from 1120, the method may include the datastore dividing the items in the table into two or more partitionsdependent on a hash of their respective hash key attribute values, as in1130. For example, if the primary key for the table is a simple key thatincludes hash key component whose values may be used to uniquelyidentify each of the items in the table, the items in the table may bepartitioned (i.e. assigned to one of a plurality of partitions)dependent a hash of the hash key attribute value, but not dependent onany other item attribute values. In some embodiments, if the primary keyis a composite key, but none of the items in the table share a hash keyattribute value (i.e. if each item has a unique hash key attributevalue), the data store may partition the items as if the primary keywere a simple key (i.e. it may partition the items in the table usingthe hash key attribute value alone).

Once the data store has assigned all of the items to a partition, thedata store may store each of the partitions on a respective storage node(e.g., a respective computing node or storage device), as in 1150. Insome embodiments, each partition of a single table may be stored on adifferent storage node, while in other embodiments, two or more of thepartitions may be maintained on the same storage node. Note that in someembodiments, the number of partitions into which the items of a giventable are partitioned may be pre-determined (e.g., it may be based onuser input/preferences, or historical data for a client, account, ortable type), while in other embodiments, the number of partitions intowhich the items of a given table are partitioned may be determined asthe partitioning operation progresses, e.g., based on the number ofitems in each range of hash results and/or the number of items in eachrange of range key attribute values. Note also that because thepartitioning is based on a hash result, the order in which groups ofitems may be assigned and distributed among the available partitions maybe somewhat randomized. In some cases, e.g., if some items are accessedmuch more frequently than others or some groups of items include ahigher number of items than others, an initial partitioning may resultin hot spots. In such cases, a repartitioning operation may be performedin order to more evenly distribute the items among the availablepartitions (e.g., with respect to data volume and/or service requesttraffic). Note also that in some embodiments, the items in a table maybe partitioned using a single hash key component and two or more rangekey components.

Table 6 below illustrates an example of the partitioning of items intable using a method similar to that illustrated in FIG. 11. In thisexample, the hash key attribute is a “User name” attribute, and therange key attribute is a “Message ID” attribute. The table storesmultiple messages associated with each of three user names (Bob, Sue,and Phil). As illustrated in Table 6, some partitions of a given tablemay include only items having the same hash key attribute value. In thisexample, a partition identified by a Partition ID value of A stores onlymessages having the hash key attribute value “Bob”. Note that thispartition does not store all of Bob's messages, only messages havingMessage ID values (i.e. range key attribute values) 1-199. Another groupof Bob's messages (those with range key attribute values 200-299) arestored in a partition identified by a Partition ID value of B. Thispartition also stores messages having a hash key attribute value of“Sue”, specifically, those messages having range key values of 1-50. Yetanother group of Bob's messages (those with range key attribute values300-399) are stored in a partition identified by a Partition ID value ofC. This partition also stores messages having a hash key attribute valueof “Phil”, specifically, those messages having range key values of1-100.

TABLE 6 User name Message ID Partition ID Bob  1 A Bob  2 A . . . Bob199 A Bob 200 B . . . Bob 299 B Bob 300 C . . . Bob 399 C Sue  1 B Sue 2 B . . . Sue  50 B Phil  1 C Phil  2 C . . . Phil 100 C

In the example above, a request to retrieve all of Bob's messages mayretrieve messages 1-199 from partition A (which may be maintained on aparticular storage node), messages 200-299 from partition B (which maybe maintained on a different storage node), and messages 300-399 frompartition C (which may be maintained on yet another storage node). Asdescribed in more detail below, in some embodiments, a request toretrieve all of these messages may be terminated early (e.g., ifresponse limit is reached), and the remaining messages may be retrievedin response to a subsequent request.

In some embodiments, the data storage service (and/or underlying system)described herein may provide two different APIs for searching the datamaintain in tables on behalf of storage service clients: a Scan API anda Query API. In some embodiments, the Scan API may be used to request anoperation that scans an entire table. A Scan request may specify one ormore filters to be applied to the results of the scan operation, e.g.,to refine the values returned to the requestor following the completescan. In some embodiments, the service (and/or underlying system) mayimpose a limit on the scan results, and the limit may be applied beforethe results are filtered. For example, in some embodiments, the systemmay use pagination (e.g., dividing a scan or query process into distinctpieces having a pre-determined maximum size in terms of the number ofitems evaluated or returned, or in terms of the amount of data scannedor returned) in order to respond to scans and/or queries quickly. Forexample, in order to scan a table that is larger than the pre-determinedmaximum size (e.g., 1 MB) or for which the resulting data set is largerthan a pre-determined maximum size (e.g., 1 MB), multiple scan or queryoperations may need to be performed to scan the entire table, in 1 MBincrements. It may be possible for a scan operation to return noresults, if no table data meets the specified filter criteria. In someembodiments, the Query API may support comparison operations to limitthe search process to the data that matches the supplied queryconditions (e.g., conditions on the attributes of the items). Forexample, a Query request may be used to find all the data in a tablethat matches the parameters specified in the request, up to apre-defined limit (if such a limit is imposed by the system). In someembodiments, a Query request may always returns results, but the systemmay return empty values if the query conditions (i.e. the attributefilter criteria) does not match any of the results.

In various embodiments, a Query API may be used to query a table that ismaintained on behalf of a storage service client (e.g., a user,customer, subscriber, or client application) for information stored inthat table. In some embodiments, the query may be performed based on aprimary index (according to a specified hash key and, in some cases, asingle range key value that satisfies a specified range key predicate).In other embodiments a primary key may include a single hash keycomponent and two or more range key components. In some embodiments, theinput parameters for a Query API may include a TableName (which may be astring comprising the name of the table in which the item to be updatedis stored or in which an item is to be conditionally inserted), anAttributesToGet parameter (which may be an array of attributes whosevalues are to be returned), a Limit parameter (which may be an integerspecifying a maximum number of results to be returned in response to asingle query request), a ConsistentRead parameter (which may be aBoolean value indicating whether a consistent read will be issued), aCount parameter (which may be a Boolean value indicating whether a countof items matching the query, rather than the attribute values of thoseitems, should be returned), a HashKeyValue (which may specify anAttributeValue for the hash component of the primary key, and may be amandatory constraint on the query), a RangeKeyCondition (which mayspecify a constraint on a RangeKey component of the primary key and may,in combination with the HashKeyValue, identify the target or targets ofthe query request), a ScanIndexForward parameter (which may be a Booleanvalue indicating whether to traverse the index forward or backward),and/or a LastEvaluatedKey parameter (which may specify a primary keyvalue to be used as a starting point of a query, if the query is acontinuation of a query for which a pre-determined limit on the numberof items for which attributes can be returned in response to a singlequery request has been exceeded).

In some embodiments, the RangeKeyCondition parameter may specify amathematical or logical expression to be evaluated dependent on valuesof the range key component of the items in the able. TheRangeKeyCondition parameter may include a ComparisonOperator parameter,and one or more AttributeValues. For example, in one embodiment theComparitionOperator may be one of the following operators: “EQ” (i.e.equal to), “GT” (i.e. greater than), “GE” (i.e. greater than or equalto), “LT” (i.e. less than), “LE” (i.e. less than or equal to), “BEGINSWITH” or “BETWEEN”. In such embodiments, if the ComparisonOperator isone of “EQ”, “GT”, “GE”, “LT”, “LE”, or “BEGINS WITH”, only one valuemay be included in the AttributeValues parameter, while if theComparisonOperator is “BETWEEN”, two values may be included in theAttributeValues parameter. Note that in some embodiments, the specifiedcomparison may be made lexicographically for attributes having the type“string” (e.g., with UTF8 strings represented as binary strings), andnumerically for attributes having the type “number”. In someembodiments, the two values specified for the “BETWEEN” operator may beinclusive, with the first value being smaller than the second value. The“BEGINS WITH” operator may be a prefix operator that is valid only forscalar strings.

The AttributesToGet parameter may include attribute types, along withtheir names, in some embodiments. In some embodiments, if attributenames are not specified for a query request (and if the Count parameteris “false”), all attributes of the items matching the query conditionsmay be returned. In some embodiments, if the Count parameter is “true”,any pre-defined limits on the number of matching items returned by thedata storage system in response to the query request may not apply.Setting the Count parameter to “true” and providing a list ofAttributesToGet (in a single query request) may be invalid, and mayresult in the data storage system returning an error indication (e.g.,an indication of a validation error). In some embodiments, if theConsistentRead parameter is set to true, a consistent read operationwill be issued. Otherwise, an eventually consistent read operation willbe performed. As noted above, if the number of items matching singlequery request exceeds the value of the Limit parameter, the query may beterminated when the limit is reached. In this case, the data storagesystem may return attribute values for a number of matching items up tothe value of the Limit parameter, and may include a continuation token(i.e. a LastEvaluatedKey parameter) that may be used to continue thequery (e.g., by including this LastEvaluatedKey as an input of asubsequent query request). Note that in some embodiments, the datastorage system may support a system-wide limit on the number of matchingitems returned in response to a query request using the Query API and/ora request-specific limit on the number of matching items (i.e. using theLimit parameter described above). In some such embodiments, a query maybe terminated and a continuation token returned to the requester wheneither of these limits is met (e.g., if a system-wide limit is met priorto meeting a request-specific limit, or vice versa).

In some embodiments, the return parameters for a Query request mayinclude an Items parameter (which may include a list of items, and/ortheir associated attribute values, that match the specified queryconditions), a Count parameter (which may indicate the number of itemsin the response), and/or a LastEvaluatedKey parameter (which, asdescribed above, may specify a primary key value of the last itemevaluated during the query prior to reaching a pre-determined limit onthe number of items about which information can be returned in responseto a single query request). As noted above, the LastEvaluatedKey may beused as a starting point in a continuation of the query if apre-determined limit on the number of items about which information canbe returned in response to a single query request has been exceeded.Note that in some embodiments, the Count parameter may always bereturned in the response for the Query API, regardless of whether thematching items (and/or their attributes) are also returned. As withother APIs provided by the data storage service, a Query request and/orresponse may be presented in a JSON request/response format or anothersuitable format, in different embodiments. Examples of a request to adata storage service and a response received from a data storage servicecorresponding to a Query API are found below, according to oneembodiment. The example below illustrates a query that may be used toretrieve all items from a table called “Pictures” for a single customer(i.e. a customer whose CustomerId is “12345678”) that have ratingsbetween “***” and “****”, and the response to that query requests,according to one embodiment.

Example Request Format:

{  Query{ “TableName” : “Pictures”, “QueryFilter” : { “CustomerId” :{“AttributeValues” : [{“S” : “12345678”}], “ComparisonOperator” : “EQ”},“Ratings” : {“AttributeValues” : [{“S” : “***”},{“S” : “****”]“ComparisonOperator” : “BETWEEN”}} }  } }Example Response Format

{ “Items”:[{ “CustomerId” : {“S” :“12345678”}, “Title”: {“S”: “sunflower”}, “DateCreated” : {“S” : “20100205T00:00:00Z”}, “Ratings” : {“S”: “***”}}, { “CustomerId” : {“S” :“12345678”}, “Title”: {“S”:“jasmine”}, “DateCreated” : {“D” : “20100206T00:00:00Z”}, “Ratings” :{“S” : “****”}}, { “CustomerId” : {“S” :“12345678”}, “Title”: {“S”:“lupine”}, “DateCreated” : {“D” : “20100301T00:00:00Z”}, “Ratings” :{“S” : “***”}} ], “Count”: 3, “LastEvaluatedKey” : [{“S”:“12345678”},{“S” : “***”}] }

One embodiment of a method for performing a query, as specified by theAPI described herein, is illustrated by the flow diagram in FIG. 12. Asillustrated at 1210, in this example, the method may include receiving aservice request to perform a query that is directed to one or more itemsin a table in a non-relational database (e.g., a table maintained onbehalf of a data storage service client). As in previous examples, therequest may include a table name (which may identify the table that isthe target of the query request), and a primary key value. If thespecified primary key value is a single attribute hash key value (i.e.if the primary key for the identified table is a simple primary keydependent on the value of a single attribute), the query may target asingle item that is uniquely identified by the combination of the tablename and the primary key value. In this case, shown as the positive exitfrom 1220, the method may include directing the query to a singlepartition of the table that includes that item, dependent on thespecified hash key value. In this case, the method may also includereturning a response that includes one or more attribute values of theidentified single item, as in 1250.

If the specified primary key value is a composite key value (i.e. if theprimary key for the identified table is a composite primary keydependent on a hash key value and a range key value), the query maytarget one or multiple items that match a specified hash key value and aspecified range key condition, as described herein. In this example, ifthe request specifies a hash key attribute value and a single range keyattribute value (e.g., if the request includes a range key conditionspecifying that the range key value is equal to a particular value),shown as the positive exit from 1240, the method may again includedirecting the query to a single partition of the table that includesthat item, dependent on the specified hash key value, and returning aresponse that includes one or more attribute values of the identifiedsingle item, as in 1250.

In this example, if the request specifies a hash key attribute value anda range key condition that may match multiple range key attributevalues, shown as the negative exit from 1240, the method may includedirecting the query to one or more partitions of the table, dependent onthe specified hash key value and range key condition, as in 1260. Forexample, if some of the items matching the specified hash key value(e.g., items whose range key values fall within a given range) arestored on one partition of the table, but other items matching thespecified hash key value (e.g., items whose range key values fall withina different range) are stored on another partition of the table, thequery may be directed to multiple partitions (and in some cases,multiple machines on which those partitions are hosted) in order toidentify all of the items that match both the specified hash key valueand the specified range key condition. In this case, the method mayinclude returning a response that includes one or more attribute valuesof one or more items matching both the hash key value and the range keycondition, as in 1270, where some of the one or more items matching boththe hash key value and the range key condition may be retrieved fromdifferent partitions (and, in some cases, different machines).

Note that a query directed to a single item (e.g., one that specifies ahash key value for a simple primary key or that specifies a hash keyvalue and a single range key value, as in the positive exit from 1240),may implement functionally similar to that of a corresponding GetItemrequest, with some variation on the number and type of parameterssupported. In some embodiments, the functionality of a GetItem API (asdescribed above) may be provided by a Query API, while in otherembodiments, the GetItem functionality describe herein and the Queryfunctionally described herein may be provided by different APIs (e.g., aGetItem API and a Query API).

A more detailed example of a method for performing a query, as specifiedby the API described herein, is illustrated by the flow diagram in FIG.13, according to one embodiment. As illustrated at 1310, in thisexample, the method may include receiving a service request to perform aquery that is directed to one or more items in a table in anon-relational database (e.g., a table maintained on behalf of a datastorage service client). As in previous examples, the request mayinclude a table name (which may identify the table that is the target ofthe query), and a primary key value. In this example, the specifiedprimary key value is a composite key value (i.e. the primary key for theidentified table is a composite primary key dependent on a hash keyvalue and a range key value), and the query may target multiple itemsthat match the hash key value and range key condition specified in therequest, as described herein. As illustrated at 1320, the method mayinclude parsing the request to determine the hash and range valuesspecified in the request.

The method may include directing the query to a partition that comprisesan initial target of the query, dependent on the specified hash andrange values, and retrieving information about one or more targets ofthe query (e.g., attribute values of the items targeted by the query)from that partition, as in 1330. For example, in some embodiments, theitems matching a particular hash key value may be ordered in the tableby their range key values. In such embodiments, the combination of thespecified hash key value and the first range key value that matches thespecified range key condition may uniquely identify the first item inthe table that matches the query conditions. In such embodiments, aquery may first be directed to the partition that contains the itemidentified by this combination. In some cases, one or more additionalitems matching the specified hash key value and the specified range keycondition may be present on the first partition to which the query isdirected, and all of these targets (i.e. the items themselves and/or aspecified subset of their attribute values) may be returned in responseto the query.

In some cases, some of the items matching both the specified hash keyvalue and the specified range key condition may be stored on one or morepartitions of the table other than the first partition to which thequery was directed. If so, shown as the negative exit from 1340, thequery may be directed to the one or more other partitions, and theseadditional query targets may be retrieved, as in 1350. For example, thenumber of items matching both the specified hash key value and thespecified range key condition may be larger than the number of itemsstored in each partition of the table. In another example, because ofthe order in which items are sorted and stored in the table and/orassigned to various partitions (e.g., in embodiments in which items aresorted in a particular order and assigned to a particular partitionaccording their range key values), the targeted items may cross apartition boundary. In these and other cases, the method may includereturning a response that includes one or more attribute values of oneor more items matching both the hash key value and the range keycondition, as in 1370, where some of the one or more items matching boththe hash key value and the range key condition may be retrieved fromdifferent partitions (and, in some cases, different physical computingnodes or storage devices).

As illustrated in FIG. 13, however, if all of the items matching boththe specified hash key value and the specified range key condition arestored on the first partition to which the query was directed, shown asthe positive exit from 1340, the method may include returning a responsethat includes one or more attribute values of one or more items matchingboth the hash key value and the range key condition, as in 1360, whereall of the one or more items matching both the hash key value and therange key condition are retrieved from the initially targeted partition(and, thus, a single physical computing node or storage device).

The use of the Query API may be further illustrated by way of thefollowing examples (i.e. by the pseudo code below). In the firstexample, a request is made to perform a query operation on a table inorder to retrieve all of the movie titles stored in the table that beginwith the word “The” and that are associated with a single customer IDnumber. This example assumes a table with composite primary key based onthe attributes “ID” and “movie titles”. This Query request may be usedto retrieve all the items for primary hash value 2 (e.g., customer ID=2)that have range values starting with “The” (i.e. movie titles that beginwith “The”):

results = Query (‘hashrange-table’, array (NUMBER => 2), array(‘RangeKeyCondition’ => array( ‘ComparisonOperator’ => BEGINS_WITH,‘AttributeValueList’ => array (array (STRING => “The”)) ) ));

As noted above, in some embodiments, the number of items returned by asingle query (prior to filtering) may be limited (e.g., to 1 MB ofdata). In such embodiments, if the query needs to return more than 1 MBof data, a second query may be set up based the primary key of the itemwith the last returned value. The Query API may use the value returnedin the LastEvaluatedKey parameter as the starting point for the secondquery. For example, the LastEvaluatedKey parameter value returned by atruncated query may be stored in a variable and provided to the nextquery as an ExclusiveStartKey input parameter value. The example pseudocode below illustrates this series of operations.

// first query results = query (‘hashrange-table’, array(NUMBER => 1),array (‘Limit’ => 2)); // retrieve the LastEvaluatedKey lastEvaluatedKey= results−>body−>LastEvaluatedKey; // create ExclusiveStartKeyexclusiveStartKey = array (‘HashKeyElement’ => array (NUMBER =>(int)lastEvaluatedKey−>HashKeyElement−>N), ‘RangeKeyElement’ => array(STRING => (string)lastEvaluatedKey−>RangeKeyElement−>S) ); // performanother query providing the LastEvaluatedKey as the ExclusiveStartKey //for the second query results = query(‘hashrange-table’, array(NUMBER =>1), array(‘Limit’ => 2, ‘ExclusiveStartKey’ => ExclusiveStartKey) );

As described herein, a composite primary key may be indexed as a hashand range index. This multi-part key may maintain a hierarchy betweenthe first and second index values. For example, the address tableillustrated below as Table 7 uses the customers' UserIDs as the hashvalue, and the year that an address was entered in the table as therange to identify each item in the address table. All entries in thetable must have a UserID and year, while each UserID/year composite keycan have any set of other attributes.

TABLE 7 Composite Primary Key Hash component Range component OtherAttributes UserID = Jennifer Year = 2011 street = 100 Pine city =Seattle state = WA UserID = Jennifer Year = 2010 street = 2020 North1^(st) St. city = Seattle UserID = Jennifer Year = 2004 zip = 97086UserID = Bob Year = 2011 street = 24 Freemont Ave zip = 95112 UserID =Bob Year = 2009 street = 400 Main St. zip = 98020 UserID = Bob Year =2004 street = 30 South Halsted St city = Chicago state = IL UserID =Harold Year = 2011 street = 20104 N. 4^(th) St. suite = 35 city =Columbus state = OH UserID = Harold Year = 2006 city = Cleveland state =OH UserID = Harold Year = 2002 zip = 97086

In this example, the UserID is a hash index, and only supportscomparisons for equality (i.e. for exact matches of the value). In thisexample, the year is a range index. Therefore, a variety of comparisonoperators may be applied to the year to constrain a search whenperforming a query on the table. For example, a Query request may beused to retrieve all of Bob's address information for the years prior to2010 (i.e. a query specifying the condition that the Year attributevalue is less than 2010). Such a query would return Bob's addressinformation for the years 2009 and 2004, as shown in the fifth and sixthentries of Table 7. Note that for other tables, such as Table 8illustrated below, a range key may be a string type attribute, such as amovie title. In this example, the table may sort items having the sameUserID in alphabetical order by the value of their Title attributevalues (i.e. their range key values), and each UserID/Title pair mayuniquely identify a single item in the table.

TABLE 8 Composite Primary Key Hash component Range component OtherAttributes UserID = Jennifer Title = Black Swan stars = 4 views = 2instant = no UserID = Jennifer Title = Gladiator stars = 5 views = 1instant = yes recommends = yes UserID = Jennifer Title = Tangled views =1 instant = yes UserID = Bob Title = Hangover stars = 5 views = 1instant = yes comment = “loved it” UserID = Bob Title = Rocky views = 1instant = no UserID = Bob Title = Sherlock stars = 3 Holmes views = 1instant = no recommends = yes UserID = Harold Title = Fair Game stars =2 views = 1 instant = yes recommends = no UserID = Harold Title = Narniastars = 5 views = 2 instant = no recommends = yes UserID = Harold Title= Zoolander stars = 4 views = 2 instant = no

In various embodiments, a Scan API may be used to retrieve one or moreitems and attributes stored in a table on behalf of a storage serviceclient by performing a full scan across the table. The items returnedmay be limited by specifying a filter. In some embodiments, the Scan APImay support richer semantics than the Query API described above. Forexample, it may support comparison operators such as “CONTAINS”, “ISNULL”, “IN”, etc.

In some embodiments, the input parameters for a Scan API may includesome of the same input parameters supported for the Query API describedabove. For example, the input parameters may include a TableName (whichmay be a string comprising the name of the table in which the item to beupdated is stored or in which an item is to be conditionally inserted),an AttributesToGet parameter (which may be an array of attributes whosevalues are to be returned), a Limit parameter (which may be an integerspecifying a maximum number of results to be returned in response to asingle query request), a Count parameter (which may be a Boolean valueindicating whether a count of items matching the query, rather than theattribute values of those items, should be returned), and/or aLastEvaluatedKey parameter (which may specify a primary key value to beused as a starting point of a scan operation, if the scan operation is acontinuation of a scan operation for which a pre-determined limit on thenumber of items for which information can be returned in response to asingle Scan request has been exceeded). The Scan API input parametersmay also include a ScanFilter parameter, which may specify a filter tobe applied to the result set. The ScanFilter may map one or moreAttributeName values to corresponding ScanCondition structures, asdescribed below. In some embodiments, all of the specified scanconditions may need to be satisfied for an item to match the filter andbe included in the result set.

In some embodiments, each ScanCondition structure may specify thecondition to match and the corresponding AttributesValues parameter mayinclude a list of attribute values against which a comparison to thescan condition will be made. In some embodiments, the scan conditionsmay be specified using a ComparisonOperator parameter having one of thefollowing values: “EQ” (i.e. equal to), “NE” (i.e. not equal to), “GT”(i.e. greater than), “GE” (i.e. greater than or equal to), “LT” (i.e.less than), “LE” (i.e. less than or equal to), “NOT NULL” (i.e. theattribute exists), “NULL” (i.e. the attribute does not exist),“CONTAINS” (i.e. a multi-valued attribute contains the specified value),“NOT CONTAINS” (i.e. a multi-valued attribute does not contain thespecified value), “BEGINS WITH”, “IN” (i.e. an attribute matches one ofthe specified values), or “BETWEEN”. In some embodiments, if theComparisonOperator is one of “EQ”, “GT”, “GE”, “LT”, “LE”, or “BEGINSWITH”, a single, scalar value may be included in the AttributeValuesparameter. If the ComparisonOperator is “IN”, all of the specifiedattribute values may be scalar and of the same type. If theComparisonOperator is “BETWEEN”, two values may be included in theAttributeValues parameter. If the ComparisonOperator is “CONTAINS” or“NOT CONTAINS”, the AttributeValues parameter may be a multi-valued orscalar string (e.g., for scalar string attributes, the comparison maytranslate to a search for substring match). If the ComparisonOperator is“NULL” or “NOT NULL”, the AttributeValues parameter may be empty (ornull), and providing any values for the AttributeValues parameter mayresult in the return of an error indication. Note that in someembodiments, the specified comparison may be made lexicographically forattributes having the type “string” (e.g., with UTF8 strings representedas binary strings), and numerically for attributes having the type“number”. In some embodiments, the two values specified for the“BETWEEN” operator may be inclusive, with the first value being smallerthan the second value. The “BEGINS WITH” operator may be a prefixoperator that is valid only for scalar strings.

The AttributesToGet parameter may include attribute types, along withtheir names, in some embodiments. In some embodiments, if attributenames are not specified for a scan request (and if the Count parameteris “false”), all attributes of the items matching the scan conditionsmay be returned. In some embodiments, if the Count parameter is “true”,any pre-defined limits on the number of matching items returned by thedata storage system in response to the scan request may not apply.Setting the Count parameter to “true” and providing a list ofAttributesToGet (in a single scan request) may be invalid, and mayresult in the data storage system returning an error indication (e.g.,an indication of a validation error). As noted above, if the number ofitems matching single scan request exceeds the value of the Limitparameter, the scan operation may be terminated when the limit isreached. In this case, the data storage system may return attributevalues for a number of matching items up to the value of the Limitparameter, and may include a continuation token (i.e. a LastEvaluatedKeyparameter) that may be used to continue the scan operation (e.g., byincluding this LastEvaluatedKey as an input of a subsequent scanrequest). Note that in some embodiments, the data storage system maysupport a system-wide limit on the number of matching items returned inresponse to a scan request using the Scan API and/or a request-specificlimit on the number of matching items (i.e. using the Limit parameterdescribed above). In some such embodiments, a scan operation may beterminated and a continuation token returned to the requester wheneither of these limits is met (e.g., if a system-wide limit is met priorto meeting a request-specific limit, or vice versa).

Note that in some embodiments, a scan process performed in response to aScan request, as described above, may not be a consistent readoperation. In other words, changes to data already “scanned” while thescan takes place may not be included in the scan results. On the otherhand, a query operation performed in response to a Query request, asdescribed above, may be an eventually consistent read operation bydefault, and may support an option to designate that the query should beperformed as a consistent read operation. Note that an eventuallyconsistent read might not reflect the results of a recently completedPutItem or UpdateItem operation, in some cases.

In some embodiments, the return parameters for a Scan request mayinclude an Items parameter (which may include an array of items, each ofwhich includes a map of attribute values that match the specified scanconditions), a Count parameter (which may indicate the number of itemsrepresented in the response), a ScannedCount parameter (which mayindicate the number of items scanned in response to the Scan request),and/or a LastEvaluatedKey parameter (which, as described above, mayspecify a primary key value of the last item evaluated during the scanoperation prior to reaching a pre-determined limit on the number ofitems whose attributes are returned in response to a single scanrequest). As noted above, the value of the LastEvaluatedKey parametermay be used as a starting point in a continuation of the scan operationif a pre-determined limit on the number of items about which informationcan be returned in response to a single scan request has been exceeded.Note that in some embodiments, the Count parameter may always bereturned in the response for the Scan API, regardless of whether thematching items (and/or their attributes) are also returned.

As with other APIs provided by the data storage service, a Scan requestand/or response may be presented in a JSON request/response format oranother suitable format, in different embodiments. Examples of a requestto a data storage service and a response received from a data storageservice corresponding to a Scan API are found below, according to oneembodiment. The example below illustrates a scan request that may beused to retrieve the titles and creation dates of all items stored atable called “Pictures” that were created after “2009-12-12T10:30:30 Z”and that have ratings “*” or “*****” (e.g., the best and the worstavailable ratings values), and the corresponding response, according toone embodiment.

Example Request Format

{ “TableName” : “Pictures”, “AttributesToGet” : [ “Title”,“DateCreated”], “MaxItemsToScan” : 1000, “Filter” : { “DateCreated” :{“AttributeValues” : [{“S” : “2009-12-12T10:30:30Z”}],“ComparisonOperator” : “GT”}, “Rating” : {“AttributeValues” : [{“S” :“*”},{“S”:“*****”}], “ComparisonOperator” : “IN”} }  } }Example Response Format

{  “Items” : [ {“Title”: {“S”: “sun flower”}, “DateCreated” : {“S” :“20100205T00:00:00Z”}}, {“Title”: {“S”: “jasmine”}, “DateCreated” : {“S”: “20100206T00:00:00Z”}}, {“Title”: {“S”: “lupine”},“DateCreated” : {“D”: “20100301T00:00:00Z”}}, ], ], “Count” : 3, “ScannedCount” : 200,“LastEvaluatedKey” : [{“S” : “some-customer”}, {“S” : “Daffodils”}] }

One embodiment of a method for performing a table scanning operation,such as the one defined by the Scan API described herein, is illustratedby the flow diagram in FIG. 14. Note that in some embodiments, scanningan entire table may involve scanning two or more partitions, which maybe hosted on two or more physical computing nodes or storage devices. Asillustrated at 1410, in this example, the method may include receiving aservice request to scan a table in a non-relational database (e.g., atable maintained on behalf of a data storage service client) and returnone or more items and/or their attributes. As in previous examples, thescan request may include a table name (which may identify the table thatis the target of the scan request). The request may also specify one ormore attributes whose values are to be returned and/or one or moreconditions by which the results of the scanning operation are to befiltered or sorted. If the request specifies filter criteria, shown asthe positive exit from 1420, the method may include scanning the table,and evaluating an item against the filter criteria, as in 1430. Asdescribed above, the filter criteria may specify values, conditions orranges of values for various attributes of the items in the table. Ifthe attribute values of the item meet the specified filter criteria(shown as the positive exit from 1440), and the request specifies one ormore attributes whose values are to be returned in the response (shownas the positive exit from 1450), the values of the specified attributesin the item may be included in the result set for the scan request, asin 1460.

If the attribute values of the item meet the specified filter criteria(shown as the positive exit from 1440), but the request does not specifyany attributes whose values are to be returned in the response (shown asthe negative exit from 1450), the values of all of the attributes in theitem may be included in the result set for the scan request, as in 1470.If the attribute values of the item do not meet the specified filtercriteria, shown as the negative exit from 1440, the item (i.e. itsattribute values) may not be included in the result set for the scanrequest. If there are more items to be processed (i.e. more items to bescanned and/or evaluated against the specified filter criteria), and ascan limit (e.g., a pre-determined limit on the number of items that canbe scanned or for which results can be returned in response to a singlescan request) has not yet been met, shown as the positive exit from1480, the operations illustrated as 1440, 1450, 1460, 1470, and/or 1480may be repeated for additional items in the table until there are nomore items to be examined or until such a scan limit has been reached.This is illustrated in FIG. 14 by the feedback from 1480 to 1440. Asillustrated in FIG. 14, once all of the items in the table have beenprocessed, or a pre-determined limit on the number of items scannedand/or returned in response to a single scan request has been met, shownas the negative exit from 1480, the method may include returning aresponse to the requester, as in 1490. As shown in 1490, and describedin more detail below, the results returned to the requester in responseto a single Scan request may in some cases include only a portion of theitems and/or attribute values that meet the specified criteria.

If the request does not specify any filter criteria (shown as thenegative exit from 1420), but the request specifies one or moreattributes whose values are to be returned (shown as the positive exitfrom 1425), the result set may include the values of the specifiedattributes for all of the items in the table. In other words, in thiscase, a complete set of results for this scan operation would includethe values of the specified attributes for all of the items in thetable. Note, however, that in some embodiments, not all of these resultscan be returned (or even necessarily discovered) in response to a singlescan request (e.g., if a pre-determined limit on the number of itemsscanned and/or returned in response to a single scan request has beenspecified for the request or by a system-wide or client-specificparameter). For example, the values of the specified attributes for afirst item in the table may be included in the result set (as in 1435)and if there are other items to process, and a scan limit has not yetbeen reached (shown as the positive exit from 1455), the specifiedattributes for one or more other items may be included in the resultset. This is illustrated in FIG. 14 by the feedback from 1455 to 1425.Once the specified attributes for all of the items have been added tothe result set, or a scan limit has been reached (shown as the negativeexit from 1455), a response may be returned to the requester thatincludes at least a portion of the result set, as in 1490. Similarly, ifthe request does not specify any filter criteria (shown as the negativeexit from 1420), and the request does not specify any attributes whosevalues are to be returned (shown as the negative exit from 1425), theresult set may include the values of all of the attributes for all ofthe items in the table. In other words, in this case, a complete set ofresults for this scan operation would include the values of all of theattributes for all of the items in the table. For example, the values ofall of the attributes for a first item in the table may be included inthe result set (as in 1445) and if there are other items to process, anda scan limit has not yet been reached (shown as the positive exit from1455), all of the attributes for one or more other items may be includedin the result set. Again, this is illustrated in FIG. 14 by the feedbackfrom 1455 to 1425. In this case, once all of the attributes for all ofthe items have been added to the result set, or a scan limit has beenreached (shown as the negative exit from 1455, a response may bereturned to the requester that includes at least a portion of the resultset, as in 1490. As illustrated in this example, in some embodiments notall of the results of a scan operation can be returned (or evennecessarily discovered) in response to a single scan request.

The use of the Scan and Query APIs described above may be furtherillustrated by way of the following examples (i.e. by the pseudo codebelow). In the first example, a request is made to scan a table, and therequest specifies that the ID values of the scanned items are to bereturned. In the second example, a request is made to scan a table andto filter the results to return all items having a primary key ID valueless than 10.

Scan (‘my-table’, array ( ‘AttributesToGet’ => ‘ID’ ) ); Scan(‘my-table’, array ( ‘AttributesToGet’ => ‘ID’, ‘ScanFilter’ => array (// WHERE ‘ID’ => array ( ‘ComparisonOperator’ => LESS_THAN,‘AttributeValueList’ => array ( array (NUMBER => 10 ) ) ) ) );

A noted above, if a pre-determined limit on the number of items scannedand/or returned in response to a single Scan or Query request has beenmet prior to discovering, collecting and returning the complete resultsfor the request, the operation may be terminated early, and the responsemay include only the items and/or attribute values retrieved prior tothe pre-determined limit being reached. In some embodiments, theresponse may include information usable as an input to a subsequent Scanor Query request that may be issued to continue scanning or querying thetable and returning additional items and/or attributes according to theparameters of the original Scan or Query request. For example, theresponse may include a LastEvaluatedKey parameter value, or anothercontinuation token, which may then be included as a corresponding inputparameter value for the subsequent Scan or Query request. In some cases,two or more subsequent Scan or Query requests may need to be performedin order to discover and/or collect and return a complete set of resultsfor a scan or query operation.

FIG. 15 illustrates a method for performing a query or scan operationfor which a scan or response limit has been specified, according to oneembodiment. As illustrated at 1510, in this example, the method includesreceiving a query or scan request directed to one or more items in atable in a non-relational database (e.g., a table being maintained by adata storage service on behalf of one or more storage service clients).As illustrated in this example, the request may be directed to a givenpartition of the table, dependent on the specified request parameters(e.g., a query condition, a hash key attribute value, a range keycondition, a scan condition, etc.), as in 1515. If an item evaluated bythe request meets the conditions or parameters of the request, one ormore attributes of that item (e.g., the values of all attributes, or thevalues of any attributes specified in the request) may be included inthe result set for the request, as in 1520. If a scan or response limitfor the request has not been met, shown as the negative exit from 1525,and if there are more items in the partition that meet the conditions orparameters of the request, shown as the positive exit from 1530, one ormore attribute values of another item, if any, that meets the requestconditions or parameters may be added to the result set. This isillustrated in FIG. 15 by the feedback from 1530 to 1520.

If a scan or response limit for the request has not been met (shown asthe negative exit from 1525), but there are no more items in thepartition currently being examined that meet the conditions orparameters of the request (shown as the negative exit from 1530), andthere are more partitions to be queried or scanned (shown as thepositive exit from 1535), the method may include directing the requestto another partition to continue the scanning or querying operation.This is illustrated in FIG. 15 by the feedback from 1535 to 1515. Inthis example, the method may include repeating the operationsillustrated in 1515-1535 one or more times, adding one or more attributevalues of other items, if any, that meet the request conditions orparameters to the result set. This is illustrated in FIG. 15 by thefeedback from 1530 to 1520. If the scan or query operation completesprior to the scan or response limit being reached for the request, shownas the negative exit from 1535, the method may include returning aresponse to the requester that includes a complete set of results and anindication that the scan or query operation was successfully completed,as in 1540.

If, at some point, the scan or response limit is reached for therequest, shown as the positive exit from 1525, the method may includeterminating the scan or query operation early (i.e. before discoveringand/or collecting a complete set of results), and returning a responseto the requester that contains partial results (those collected in theresult set before reaching the scan or response limit) and acontinuation token (such as a LastEvaluatedKey parameter value). This isillustrated in FIG. 15 at 1545. If there are still more items to beexamined, shown as the positive exit from 1550, a subsequent query orscan operation may be initiated that includes the continuation token asone of its input parameters. This subsequent query or scan operationwould begin scanning or querying the table at the point at which theprevious operation was terminated, as shown in 1560. If there are nomore items to be examined after reaching the limit and terminating theoperation, shown as the negative exit from 1550, the scan or queryoperation may be complete, as in 1570.

Some of the error indications that may be returned by various ones ofthe APIs supported in the data storage system herein have been describedabove. Others are listed in Table 9 below.

TABLE 9 List of Errors Http Status Conditions under Code Error CodeError Message which the error is raised 400 InvalidParameterValue One ormore parameter One or more parameter values were invalid values wereinvalid, or a string parameter exceeded a length restriction. 400MissingParameterValue One or more required One or more requiredparameter values were parameter values were missing missing. 400ResourceInUse The resource which is Examples: An attempt to beingattempted to be re-create an existing changed is in use table, or anattempt to delete a table that is in the Creating state. 400ResourceNotFound The resource which is Example: A table that is beingrequested does not being requested does not exist exist. 400ConditionCheckFailed The conditional request Example: An expected failedvalue did not match what was stored in the system. 500 InternalFailureThe server encountered Example: internal error an internal error tryingto fulfill the request. 500 ServiceUnavailable The service is currentlyExample: the system is unavailable or busy throttling requests

Note that in some embodiments, the following error indications may bereturned by any of the APIs supported by the service, while others maybe returned by specific ones of these APIs.

InvalidParameterValue

MissingParameterValue

InternalFailure

ServiceUnavailable

In some embodiments, any or all of the metadata described herein asbeing used in maintaining and managing tables on behalf of a datastorage service client (including any of the metadata tables describedherein) may be stored in the same scalable data store (e.g., the samenon-relational database) as that in which the client/user tables arestored. In such embodiments, the system may include or employ one ormore bootstrapping mechanisms to assist with initialization of the datastorage service (and/or the underlying system that implements a datastorage service), some of which are described herein. FIG. 16illustrates a portion of a data model for such a system, according toone embodiment. In this example, various computing nodes (represented inthe data model simply as “nodes 1610”) may store user data (e.g., intables maintained on behalf of a user) and/or system data, includingmetadata used by the data storage service, such as that described above.Therefore, each node 1610 of the data model may include an indicator ofthe type of the node, shown as node-type 1615. For example, in oneembodiment, each node may be designated as a “storage node”, a “requestrouter”, an “auto-admin” node, or a “staging” node. In some embodiments,a “storage node” may store user data in one or more tables maintained bythe data storage service, but metadata (e.g., data stored in one or moreof a Tables Table, a Subscribers Table, a Partitions Table, or a NodesTable) may be hosted on other types of nodes (e.g., “auto admin” nodesand/or “staging” nodes). In other embodiments, such metadata may bestored on one or more “storage nodes”, some of which may also store userdata. As illustrated in FIG. 16, each node 1610 may also include anidentifier of the node (shown as node-id 1620), and one or more otherelements (shown as 1630).

As illustrated in FIG. 16, information about each replica may berepresented in the data model as a replica 1640. Each replica 1640 inthe data model may include an identifier of the node on which thereplica is hosted (shown again as node-id 1620), and one or morepartition identifiers (shown as partition-id 1635) indicating thepartitions included in the those replicas. In this example, eachpartition may be represented in the data model as a partition 1650 andmay include its partition-id 1655. As illustrated in FIG. 16 by variousone-to-many mappings, each node may host multiple replicas, and eachpartition may be included in multiple replicas.

In some embodiments, the systems described herein may support seamlessscaling of user tables in a “fully shared nothing” type architecture.For example, in some embodiments, each partition may be implemented as acompletely independent parallel computation unit. In such embodiments,the system may not provide distributed coordination across partitions orsupport batch “put” operations and/or multi-statement transactions. Insome embodiments, as long as the workload distribution is well spreadacross partitions, an increase in the number of partitions may result ina larger usable table size and/or increased throughput capacity forservice requests. As described herein, in some embodiments, liverepartitioning (whether programmatic/automatic or explicitly initiated)may be employed to adapt to workload changes. In other words, in someembodiments, repartitioning (including partition moving, partitionsplitting, and other repartitioning operations) may be performed whileservice requests directed to the affected partitions continue to bereceived and processed (i.e. without taking the source partitionoff-line).

In different embodiments, the data storage service (and/or underlyingsystem) may support a variety of service offerings and/or throughputmodels. For example, in some embodiments, the service may support acommitted throughput offering and/or a best effort offering. In someembodiments, a storage service client (e.g., a client application, user,or subscriber having access to the service) may specify a preferencebetween multiple throughput options that are offered by the service,according to a variety of business models, subscription types, and/orpayment models. For example, the client/user may indicate a preferredthroughput model for a particular table through a parameter of a requestto create the table, in some embodiments. In other embodiments, aclient/user may specify a default throughput model for all tablescreated and maintained on their behalf by the data storage service. Bysupporting both a committed throughput model and a best effortthroughput model (for which no throughput guarantees are made), thesystem may allow clients/users to make a trade-off between performanceand cost, according to their needs and/or budgets.

A data storage service (and underlying system) that provides a committedthroughput offering may be configured to pre-allocate capacity and/orresources for the creation, growth, and management of a table maintainedon behalf of a client/user in response to traffic directed to the table,and not to overbook the resources and/or capacity of the storage node(s)on which that table is maintained. In some embodiments, tablesmaintained by the service (and underlying system) under a committedthroughput model may be maintained in faster (and often more expensive)storage resources, such as high performance media (e.g., flash memory orSolid State Drive, or SSD, media), in order to provide extremely lowlatencies when servicing requests from the client/user. For example, thesystem may provide (and dedicate) a high ratio of fast/local memory tomain (e.g., disk) memory for the maintenance of those tables (andvarious partitions thereof). While the storage resources allocated to agiven table under a committed throughput model may in some cases beunderutilized (at least some of the time), the client/user may value thepredictable performance afforded by the committed throughput model morethan the additional (and in some cases wasted) costs of dedicating moreresources than may always be necessary for that table.

Note that in various embodiments, the committed throughput level for agiven table (or client/user) may be specified in terms of the work doneduring a given time period when a service request targets the table. Forexample, the committed throughput level may be expressed in terms oflogical or physical I/O throughput (e.g., logical or physical I/Oaccesses per second) or logical CPU throughput (e.g., CPU cycles orinstruction cycles per second), in some embodiments. Note that in someembodiments, a read access to the table may require only one I/O access(e.g., to read the data file of the table), while a write access to thetable (e.g., an access that adds, deletes, or modifies an item or itemattribute in the table) may require at least two I/O accesses (e.g., tolog the write access, and then to perform the access). In addition, asdescribed herein, some individual service requests may read and/or writemultiple items and/or item attributes in the table. Therefore, in someembodiments, rather than specifying the committed throughput in terms ofa number of I/O operations per second (IOPS) or a number of servicerequests (i.e. API calls) per second, the committed throughput level maybe specified in terms of a measure of normalized, logical work units (orlogical service request units) over time. In one example, the committedthroughput level may be specified (in terms of normalized logicalservice request units) such that a service request that results in aread access targeting a single item in a table may be considered torequire (or consume) one logical service request unit, while a servicerequest that results in a write access targeting a single item in atable may be considered to require (or consume) two or three logicalservice request units. Note that in some embodiments, throughput levelsmay be specified differently for read requests and write requests (e.g.,as a specified number of read accesses per second and a separatelyspecified number of write accesses per second), and/or logical servicerequest units consumed by read requests and write requests may benormalized based on the sizes of the items accessed by those requests.In yet another example, a different committed throughput level may bespecified for read accesses performed under an eventual consistencymodel than for read accesses performed under a strong or strictconsistency model. In some embodiments, the work done by servicerequests that include multiple read and/or write accesses (e.g., a queryor scan request that may return anywhere from 0 to 1 MB of data) may bemodeled in terms of logical service request units, which may bedependent on the number of logical work units that are required toservice those requests and/or on the size of the item or items accessedby each of those requests. In various embodiments, the number ofphysical I/O operations (e.g., memory accesses) actually performed whenservicing the request may be a fixed or varying multiple of the numberof logical service request units required (or consumed) when servicingthe request. For example, in some embodiments the number of physical I/Ooperations performed when servicing a given request may on the order oftwice the number of logical service request units required (or consumed)in servicing the request. As used herein, the terms “logical servicerequest units” and “logical service request units per second” may beused to describe these and any other suitable methods for measuringand/or specifying the throughput level under a committed throughputmodel.

In some embodiments, clients/users receiving services under a committedthroughput model may proactively request and/or purchase additionalcapacity or resources in anticipation of an increase in table sizeand/or service request traffic. For example, a client/user may specify(e.g., in a service request to create a table) a committed throughputlevel of 10,000 logical service request units per second for trafficdirected to the table. In response, the data storage service (andunderlying system) may automatically create 20 partitions for the table,and may reserve enough resources and/or capacity to support 500 logicalservice request units per second directed to each of the 20 partitions.In some embodiments, this may translate to something on the order of1000 I/O operations to physical memory (e.g., disk). After the systemhas been configured to provide the initially requested committedthroughput level, the client/user may request a temporary or permanentincrease or decrease in the committed throughput level, and in response,the system may be configured to automatically add resources/capacity tothose reserved for the table or remove resources/capacity from thosereserved for the table to modify the amount of reservedresources/capacity such that it is commensurate with the requestedmodification. In some embodiments, a system that provides a committedthroughput model may allow optional bursting to support short-termincreases or spikes in traffic beyond that of the committed throughputlevel. For example, the system may configured to automatically acceptand service additional logical service request units up to apre-determined burst allowance level (after which it may or may notaccept and service additional logical service request units), and mayreserve enough resources for the table to be able handle traffic equalto the committed throughput level plus the burst allowance level. Inother embodiments, the system may only accept and service additionallogical service request units opportunistically (e.g., if resources andcapacity are available) but without any guarantee to service thoseadditional logical service request units. In still other embodiments,the system may strictly cap the logical service request units acceptedand serviced at the amount corresponding to the committed throughputlevel, after which additional service requests may be throttled.

In one example, a client/user may request an increase in the committedthroughput level for a table ahead of a planned or expected temporaryburst or spike in demand (e.g., due to a sale, promotion, announcement,new release, or other event that may trigger increased activity directedto the table or a partition thereof) or in response to observing thatdemand is approaching the current committed throughput level. In anotherexample, after preparing for and observing a temporary increase indemand for a given table, a client/user may submit a request to returnthe committed throughput level to its initial level, or to a new levelcommensurate with the expected demand going forward (e.g., a “newnormal” for the table). In some embodiments, the data storage service(and underlying system) may allow the client/user to “re-negotiate” thecommitted throughput level for a table following a drop in demand(whether planned or not), which may allow the client/user to reducecosts associated with reversing a larger amount of resources/capacitythan will be subsequently needed. In some embodiments, the data storageservice (and underlying system) may allow the client/user to requestthat a given table be managed under a best effort throughput model,rather than a committed throughput model, following an initial period ofhigh demand for which higher performance (i.e. lower latencies) aredesired. In such embodiments, a portion of the resources/capacityallocated to or reserved for the table may be deallocated/unreserved(e.g., based on client/user-estimated demand, historical data, orsystem-wide, account-specific, or client-specific defaults), andsubsequently received service requests that target the table may behandled opportunistically (as resources/capacity are available).

A data storage service (and underlying system) that provides a besteffort throughput offering may be configured to run on more traditionalspinning media (e.g., disk media), which may result in lower storagecosts, but higher latencies. When managing a table under a best effortthroughput model, the system may be configured to respond automaticallyto increases in traffic or data storage volume (i.e. without placing anadministrative burden on clients/users or requiring their intervention),and may throttle at least some service requests until efforts to attemptto handle the increases are carried out. For example, in someembodiments, the system may be configured to throttle at least a portionof incoming service requests while adding partitions in response toworkload changes and/or repartitioning data being managed by the serviceon behalf of storage service clients (e.g., users, subscribers, orclient applications) in response to increased in traffic and/or datavolume. While a best effort throughput model may cost less for theclient/user, it may not be able to keep up with rapidly changingworkloads. In other words, in situations in which the workload directedto a given table that is managed under a best effort throughput modelcan change rapidly, the overall performance of applications that targetthe given table may suffer (as compared to the performance of those thattarget tables managed under a committed throughput model in which theworkload does not exceed the committed throughput level or in whichchanges in the workload are predictable and are handled pro-actively bymodifying the committed throughput level ahead of increased demand).

One embodiment of a method for creating and managing a table on behalfof a data storage service client (e.g., a user, subscriber, or clientapplication) according to a specified throughput model is illustrated bythe flow diagram in FIG. 17. As illustrated at 1710, in this example,the method may include a component of the system that implements thedata storage service receiving a service request to create a table in anon-relational database (e.g., a table to be maintained on behalf of aclient/user of a data storage service). In some embodiments, aclient/user may submit a service request to the service (or theunderlying data store) to create a table that conforms to an API thatincludes a parameter for specifying a throughput model to be used whenservicing requests directed to the table (e.g., a best effort throughputmodel or a committed throughput model). In such embodiments, the requestmay also include an indication of the requested throughput level forwhich a commitment is sought. In some embodiments, the data storageservice (and underlying system) may support the use of a system-wide,account-specific, or client-specific default for the throughput model tobe used when creating a new table on behalf of the client/user. In somesuch embodiments, the request to create the table may not include anindication of a throughput model preference, but may include anindication of the requested throughput level for which a commitment issought.

If the client/user has specified a preference for a committed throughputmodel, shown as the positive exit from 1715, the method may include thesystem pre-allocating enough capacity and/or resources to support therequested committed throughput level for traffic directed to this and/orany other tables being maintained on behalf of that user, as in 1730.For example, if the client/user is a subscriber who has paid for theprivilege of receiving a particular throughput commitment, the systemmay pre-allocate sufficient resources and/or capacity (including, forexample, storage resources allocated in an appropriate number ofpartitions, I/O throughput, CPU resources, and/or other resources of thedata storage system) to meet that commitment. Note that in someembodiments, storage resources allocated for tables managed under acommitted throughput model may include faster (and more expensive)storage resources than memory allocated to tables managed under a besteffort throughput model. If the client/user subsequently requests acommitment for increased throughput or requests a reduction in thecommitted throughput level, as in 1750, the system may be configured toallocate or deallocate capacity and/or resources for that table to becommensurate with the requested modification to the committed throughputlevel, as in 1770. For example, in some embodiments, the client/user maybe able to pay for a temporary or permanent increase in throughput (thusmodifying the requested level of committed throughput), and the systemmay be configured to re-allocate resources and/or capacity accordingly(e.g., in response to the change in the client/user's accountinformation). In some embodiments, such a request may be made by theclient/user that created the table or by another privileged user (i.e.one authorized to make changes in the configuration of the table) inaccordance with an API that includes one or more parameters forconfiguring and/or re-configuring tables maintained by the data storageservice on behalf of clients/users. In some embodiments, following arequest for a temporary increase in capacity and/or resources, theclient/user may request (and receive) a decreased level of support interms of capacity and/or resources.

If the user has not specified a preference for a committed throughput(e.g., if a best effort model is specified in the table creation requestor a system-wide, account-specific, or client-specific default for thethroughput model to be used when creating a new table on behalf of theclient/user indicates that a best effort throughput model should beapplied when managing requests directed to the table), shown as thenegative exit from 1715, the method may include the system allocatingcapacity and/or resources to support an initial volume and/ordistribution of traffic directed to the table, as in 1720. For example,if the user is a subscriber who has paid not for the privilege ofreceiving a particular throughput commitment, but who has indicated thata best effort throughput model is sufficient for their needs, the systemmay allocate an initial amount of resources and/or capacity based on abest effort throughput model. In various embodiments, the initial amountof resources and/or capacity allocated to the new table may be dependenton historical volumes and/or patterns of service requests for thisand/or other clients/users, a volume or distribution of service requestspredicted by the client/user (which in some embodiments may be specifiedin the table creation request), system-wide, account-specific, orclient-specific defaults or configurable parameter values for theresources and/or capacity initially allocated to newly created tables,and/or other factors. Note that in some embodiments, memory in whichtables managed under a best effort throughput model are maintained maybe cheaper (and slower) than memory in which tables managed under a besteffort throughput model are maintained.

If the system detects an increase in traffic and/or volume of data(e.g., if the increased traffic results in the system not being able toservice all of the requests or the volume of data to be storedapproaches the allocated capacity), shown as in the positive exit from1725, the system may be configured to throttle requests until or unlessadditional capacity and/or resources can be put in place to support thetraffic or data volume increase, as in 1740. For example, in response todetecting increased traffic directed to one or more tables (orpartitions thereof), or a volume of data in the table that isapproaching the currently allocated capacity for the table (or apartition thereof), the system may be configured to automatically addpartitions, move partitions, or otherwise repartition the data in thetable and/or in one or more other tables in an attempt to service theclient/user at the increased traffic or data volume level.

Similarly, if the system detects a decrease in traffic and/or volume ofdata (e.g., over a sustained period of time), shown as in the negativeexit from 1725, the system may be configured to remove or deallocatecapacity and/or resources for the table so that the amount of capacityand/or resources dedicated to the table are more in line with theobserved demand, as in 1760. For example, in response to detectingdecreased traffic (or traffic that remains well below the level that canbe supported by currently allocated resources and capacity) directed tothe table (or one or more partitions thereof), or a volume of data inthe table (or one or more partitions thereof) that is (and has been forat least a pre-determined period of time) well below the currentlyallocated capacity for the table or its partition(s), the system may beconfigured to automatically remove one or more partitions, collapsemultiple partitions into a single partition, deallocate memory orthroughput capacity for one or more partitions, or otherwise repartitionthe data in the table in an attempt to better match the resources andcapacity that are allocated to the table to the observed demand. Asillustrated in FIG. 17, while the traffic and/or data volume remainwithin a range that can be serviced with reasonable performance usingthe initially allocated capacity and/or resources, shown as the negativeexits from 1725 and 1745, the data storage service (and underlyingsystem) may maintain the initial capacity and resources for the table,as in 1780.

Note that in various embodiments, any or all of operations illustratedin FIG. 17 may be repeated in order to create, and subsequentlymaintain, tables managed by the data storage service while the tablesremain active. Note that in some embodiments, any or all of detectingchanges in the workload or data volume, throttling incoming servicerequests and/or modifying the number of partitions and/or amount ofresources/capacity allocated, reserved, or available for a given tablemay be performed by an auto admin instance that initially allocatesresources and subsequently modifies those allocations in response tochanging conditions and/or requests made by a client/user.

As noted above, in various embodiments in which tables are managed usinga committed throughput model, the system may allow modifications to thecommitted throughput level for those tables, e.g., it may allowtemporary and/or permanent changes in the committed throughput level.FIG. 18 is a flow diagram illustrating one embodiment of a method forservicing requests directed to a particular table while maintaining ormodifying a committed throughput level. As illustrated at 1810, in thisexample, a data storage service (or underlying data store) may manage atable on behalf of a client/user under a committed throughput model.Note that in some embodiments, memory allocated for tables managed undera committed throughput model may include faster (and more expensive)memory than memory allocated to tables managed under a best effortthroughput model. In this example, if, at some point, the observeddemand (in terms of throughput when servicing requests that target thetable or various partitions thereof) exceeds the committed throughputlevel (shown as the positive exit from 1820) and if some amount ofbursting and/or spikes in throughput (e.g., up to a pre-determined burstallowance level) are supported by the system (shown as the positive exitfrom 1830), the method may include the system servicing at least aportion of the additional demand (servicing additional throughput up tothe pre-determined burst allowance), as in 1840. In this example, it isassumed that additional resources are reserved for the table to meet thecommitted throughput level and the pre-determined burst allowance level.In other embodiments, bursting or spikes in throughput may only besupported opportunistically (e.g., if resources and/or capacity that arenot reserved for the table happen to be available).

As illustrated in FIG. 18, if the observed demand exceeds the committedthroughput level (shown as the positive exit from 1820), but burstingand/or spikes in throughput are not supported by the system (shown asthe negative exit from 1830), and there are not sufficient resourcesavailable to service at least a portion of the additional demand (shownas the negative exit from 1835, the method may include the systemthrottling service requests that are directed to the table to match thecommitted throughput level, as in 1845. In some embodiments, if demandexceeds the committed throughput level (shown as the positive exit from1820), and bursting and/or spikes in throughput are not supported by thesystem (shown as the negative exit from 1830), but there are sufficientresources available to service at least a portion of the additionaldemand (shown as the positive exit from 1835, the method may include thesystem servicing at least a portion of the additional demand, as in1840. In other words, in some embodiments, any additional demand (demandthat exceeds the committed throughput level) may be servicedopportunistically, but may not be guaranteed. As noted above, servicingrequests that exceed a committed throughput level (whether through apolicy for allowing bursts/spikes or opportunistically) may in someembodiments result in additional charges to a client/user account beyondthose for providing the committed throughput level.

As illustrated in this example, if the observed demand does not exceedthe committed throughput level (shown as the negative exit from 1820),but a service request is received indicating a request for an increasedcommitted throughput level (as in 1850), the method may include thesystem adding one or more partitions and/or additionalresources/capacity to support the requested increase in the committedthroughput level, as in 1855. For example, if the client/user expects atemporary or permanent increase in demand (in terms of throughput whenservicing requests that target the table), the client/user may in someembodiments pro-actively request an increase in the committed throughputlevel so that the system will be handle the increased demand withoutwaiting for it to react to the increase demand. In response, the systemmay add one or more partitions (along with the associated I/Othroughput) and/or may change the configuration of the system toaccommodate the request (e.g., by adjusting the portion of the I/Othroughput that is allocated to the table from the total throughputsupported in the system or on particular computing nodes thereof. Forexample, in some embodiments, in response to a service request foradditional resources to support an expected increase in traffic or datavolume, the system may split a partition into multiple partitions,create additional copies (replicas) of a partition, and/or move variouspartitions replicas to machines that can provide additional storage orI/O capacity using any of the techniques described herein. In anotherexample, in response to a request to increase the committed throughputlevel for a given table from 1000 logical request units per second to2000 logical request units per second, the system may double the numberof partitions for the table, or may double the I/O throughput that isallocated to each of the partitions for the table.

In some embodiments, if the increased demand is expected (or observed)to be temporary, or in response to decaying demand following a period ofincreased demand, the client/user may request that the committedthroughput level be decreased (e.g., to the previous committedthroughput level, or to a different “new normal” committed throughputlevel). In this case, shown at 1860, the system may be configured toremove one or more partitions, collapse multiple partitions into asingle partition, deallocate memory or throughput capacity for one ormore partitions, and/or repartition the data in the table in an attemptto better match the resources and capacity that are allocated to thetable to the decreased committed throughput level, as in 1865.

Note that in some embodiments, if the client/user expects the demanddirected to the table (and/or various partitions thereof) to remain at arelatively low level for the remainder of the time that the table isactive, the client/user may indicate in the request for a decreasedcommitted throughput level that it no longer needs or desires anycommitment (or corresponding guarantee) on the throughput level for thetable. In other words, the request may indicate a committed throughputlevel of zero, which may effectively indicate a request to manage thetable using a best effort throughput model rather than a committedthroughput model when subsequently servicing requests directed to thetable. This is illustrated in FIG. 18 by the positive exit from 1870 andelement 1880. Note that in some embodiments, memory in which tablesmanaged under a best effort throughput model are maintained may becheaper (and slower) than memory in which tables managed under a besteffort throughput model are maintained. If the request for a decreasedcommitted throughput level does not indicate that the client/user nolonger needs or desires a commitment (and corresponding guarantee) onthe throughput level for the table, shown as the negative exit from1870, the system may continue to manage the table using a committedthroughput model (e.g., according to the current committed throughputlevel), as in 1875.

Note that in various embodiments, any or all of operations illustratedin FIG. 18 may be repeated in order to create, and subsequently maintaintables managed by the data storage service while the tables remainactive.

In various embodiments, there may be situations in which a partition (ora replica thereof) may need to be copied, e.g., from one machine toanother. For example, if there are three replicas of a particularpartition, each hosted on a different physical or logical machine, andone of the machines fails, the replica hosted on that machine may needto be replaced by a new copy (replica) of the partition on anothermachine. In another example, if a particular machine that hosts variousreplicas of multiple partitions of one or more tables experiences heavytraffic, one of the heavily accessed partition replicas may be moved(e.g., using a copy operation followed by an operation to redirecttraffic) to a machine that is experiencing less traffic in an attempt tomore evenly distribute the system workload and improve performance. Insome embodiments, the data storage service (and/or underlying system)described herein may perform replica moves and/or replica copying usinga physical copying mechanism (e.g., a physical file system mechanism)that copies an entire partition replica from one machine to another,rather than copying a snapshot of the partition data row by row (as in atraditional logical database partition copying operation). As describedin more detail below, in some embodiments, all write operations may belogged before being applied to a particular partition (and/or variousreplicas thereof), and they may be applied to the partition (i.e. to thereplicas thereof) periodically (e.g., in batches). In such embodiments,while a partition replica is being copied, write operations targetingthe partition may be logged. During the copy operation, these loggedwrite operations may be applied to the partition at periodic intervals(e.g., at a series of checkpoints). Once the entire partition has beencopied to the destination machine, any remaining logged write operations(e.g., any write operations performed since the last checkpoint, or anywrite operations that target portions of the partition that were copiedto the destination prior to those write operations being logged) may beperformed on the destination partition replica by a final catch-upprocess. In some embodiments, the catch-up process may examine thesequentially ordered write operations in the log to determine whichwrite operations have already been applied to the destination partitionreplica and which, if any, should be applied to the destinationpartition replica once the physical copying of the partition data iscomplete. In such embodiments, unlike with traditional partition copyingor moving mechanisms, the data in the destination partition replica maybe consistent following the completion of the operation to move/cove thepartition replica.

One embodiment of a method for moving (or copying) a replica of apartition of a table being maintained by a data storage service onbehalf of a storage service client while the partition is “live” isillustrated by the flow diagram in FIG. 19. In this example, the methodmay include a component of the system that implements the data storageservice receiving a request to move a replica of a partition, as in1910. For example, the system may receive an explicit request to move areplica from a client/user or system administrator, or such a requestmay be automatically generated in the system in response to detecting ananomaly (as described in more detail below). As illustrated at 1920, inresponse to receiving the request to move the partition, the system maybe configured to create a new replica (which may be referred to as adestination replica), while the partition is live (i.e. while one ormore replicas of the partition continue to accept and service requestsdirected to the partition). In some embodiments, creating a destinationreplica may include selecting a computing node or storage device onwhich to create the destination replica, allocating memory on thecomputing node or storage device for the destination replica, creatingor updating metadata associated with the partition and/or thedestination replica, and/or performing other functions appropriate forcreating the destination replica.

As illustrated in this example, the method may include the systemcopying table data from the replica being moved (or from another sourcereplica storing the same table data as the replica being moved) to thedestination replica using a file copy mechanism or another physical copymechanism while one or more replicas of the partition are live, as in1930. In other words, the replica may be copied to the new destinationreplica using an operation that copies the physical locations of thereplica data, rather than using a logical copying operation (e.g., onethat reads and copies table data on a row-by-row basis). As illustratedat 1940, after performing the physical copying operation, the method mayinclude the system performing a catch-up operation to reconcile anychanges to the replica data that were made during the copy operation butthat are not yet reflected in the new copy. This catch-up operation isdescribed in more detail below. Once the destination replica has beencreated and populated, the method may include directing traffic awayfrom copied replica and toward the new designation replica, as in 1950.For example, the system may configure the new destination replica toreceive and service requests targeting table data that was maintained onthe particular partition replica and some or all service requeststargeting the partition may be directed away from the source replica andtoward the new destination replica.

In some embodiments, the storage engine for the underlying data store ofa data storage service (e.g. a non-relational database) may storereplica data in database files, and each replica (and database file) maybe associated with a recovery log. In such embodiments, when a servicerequest to modify the replica data is received, it may be logged in therecovery log before being applied to the replica. In the case of a nodefailure or system crash, the changes logged in the recovery log may bereapplied to a previous snapshot or checkpoint of the replica data torecover the contents of the replica. As noted above, in someembodiments, the data storage service (and its underlying system) maysupport a replica move operation and/or a replica copying operation thatemploys a physical copy mechanism. In some such embodiments, thephysical copy mechanism may employ such a log, which may ensure that thereplica data that is moved to a new destination is consistent. FIG. 20illustrates one embodiment of a method for copying a replica using aphysical copy mechanism, as described above. In this example, the methodbegins copying replica data from its current physical storage locationsto corresponding physical destination locations, as in 2010. In someembodiments, the physical copy operation may include copying pages fromone physical storage device (e.g., disk storage) to a destinationstorage device over a network.

As illustrated at 2020, during the physical copying operation, writeoperations targeting the partition whose replica is being copied may belogged before being applied to the replica being copied, as describedabove. In various embodiments, each logged write operation (or group ofwrite operations) may be assigned a log sequence number. In someembodiments, the logged changes may be applied to the replica beingcopied (and/or to other replicas that store the same table data) atperiodic checkpoint intervals. In the example illustrated in FIG. 20,when a pre-determined checkpoint interval passes, shown as the positiveexit from 2030, all of the modifications (e.g., write operations) loggedsince the last checkpoint may be applied to the replica being copied(e.g., the source replica) and/or to other replicas that store the sametable data. Because these updates are applied while the source replicais being copied, some of these modifications will be reflected in thedestination replica as a result of the copying operation (e.g.,modifications that were applied to a given portion of the replica databefore that portion of the data was copied to the destination). Othermodifications may not be reflected in the destination replica followingthe copying operation (e.g., modifications that were applied to a givenportion of the replica data after that portion of the data was copied tothe destination).

As illustrated in FIG. 20, the method may include continuing to copyreplica data from current physical storage locations to correspondingphysical destination locations while it is not complete (shown as thenegative exit from 2050, element 2060, and the feedback to 2020). Themethod may include continuing to log write operations (as in 2020) andto apply logged write operations to the source replica, i.e., thereplica being copied, (as in 2040) each time the checkpoint intervalpasses (shown as the positive exit from 2030). Once the physical copyoperation is complete (shown as the positive exit from 2050), the methodmay include performing a catch-up operation, in which any logged writeoperations that are not already reflected in the destination replica areapplied to the destination replica, as in 2070. Thereafter, if thecopying of the partition was performed as part of an operation to movethe partition replica, some or all accesses targeting the partitionwhose replica was copied may be directed away from the source replicaand directed toward the new destination replica. For example, any writeoperations targeting the partition may be logged in a recovery log forthe destination replica, and subsequently applied to the destinationreplica (e.g., at the next periodic checkpoint). In some embodiments,following the copying of the replica to a new destination (e.g., as partof a move operation), the log in which modifications to the sourcereplica were logged may be copied (or used directly) for the recoverylog for the destination replica.

In some embodiments, the replica copying process described above may beemployed in partition splitting operations. For example, a partition maybe split because it is large (e.g., because it is becoming too big tofit on one machine) and/or in order to keep the partition size smallenough to quickly rebuild the partitions hosted on a single machine(using a large number of parallel processes) in the event of a machinefailure. A partition may also be split when it becomes too “hot” (i.e.when it experiences a much greater than average amount of traffic ascompared to other partitions). For example, if the workload changessuddenly and/or dramatically for a given partition, the system may beconfigured to react quickly to the change. In some embodiments, thepartition splitting process described herein may be transparent toapplications and clients/users, which may allow the data storage serviceto be scaled automatically (i.e. without requiring client/userintervention or initiation).

Note that in some embodiments, moving (or copying) a replica of apartition in a cluster may be quicker than splitting a partition,because the system may take advantage of the file copying processdescribed above for replica copying. Splitting a partition, on the otherhand, may require logically dividing the partition data in oneunderlying data structure (e.g., one B-tree) into two such datastructures (e.g., two B-trees), which is generally less efficient thanmoving an entire replica, as described above. Therefore, in someembodiments, a partition splitting process may include creatingadditional replicas of the partition, and thereafter managing only aportion of the partition data on each replica. For example, if there arethree replicas of a given partition that is to be split, the partitionsplitting process may include creating three additional copies of theentire partition (e.g., using the partition copying process describedabove). These resulting six replicas may be split into two new replicagroups of three replicas, each of which may be configured to beresponsible for handling service requests directed to half of theoriginal partition data by invoking an operation to split theresponsibilities between the replica groups. For example, following theoperation to split the responsibilities, service requests directed todata in a designated portion of the original partition may be acceptedand serviced by replicas a given replica group, while service requeststargeting the remaining data of the original partition may be rejectedby that replica. In some embodiments, the partition data for which agiven replica is not responsible may eventually be removed (e.g., sothat the memory allocated to the replica for data it no longer supportsmay be subsequently used to store new items in the replica), or thememory in which it was stored may be reclaimed by the system (e.g., sothat the memory allocated to the replica for data it no longer supportsmay be subsequently used by another partition). Removal of unsupporteddata or reclamation of memory may be performed by background taskswithout affecting the performance of the data storage system, and may betransparent to clients/users.

In some embodiments, each partition may be identified by a partition ID,which may be a unique number (e.g., a GUID) assigned at the time thepartition is created. A partition may also have a version number that isincremented each time the partition goes through a reconfiguration(e.g., in response to adding or removing replicas, but not necessarilyin response to a master failover). When a partition is split, two ormore new partitions may be created, each of which may have a respectivenew partition ID, and the original partition ID may no longer be used.In some embodiments, a partition may be split by the system using asplit tool or process in response to changing conditions. For example, ascheduled task of an auto admin instance may monitor partition sizes and“heat” (e.g., traffic directed to each partition), and may applypolicies that determine when to use the splitting tool/process toperform a split. In some embodiments, the splitting tool and auto admininstance may avoid attempting two splits at the same time by employing alock manager.

In some embodiments, the monitoring component may provide a list ofpartitions that meet the split criteria to the splitting tool/process.The criteria may be based on partition size and heat, where heat may betracked by internally measured metrics (such as IOPS), externallymeasured metrics (such as latency), and/or other factors. In someembodiments, the splitting tool/process may receive a request to split apartition from the monitoring component that includes a partition ID anda version number for the partition to split, and a list of machines(e.g., machines in the same cluster or storage silo that are known to belightly loaded) for the location(s) of the new partitions/replicas.Including the version number as an input to the splitting tool/processmay ensure that the splitting tool/process does not attempt to split apartition that has already gone through one or more reconfigurationssince the last time it was evaluated against the split criteria, as thesplitting tool/process may reject the request if version number does notmatch.

One embodiment of a method for splitting a partition of a table beingmaintained by a data storage service on behalf of a storage serviceclient is illustrated by the flow diagram in FIG. 21. In this example,the method may include a component of the system that implements thedata storage service receiving a request to split a partition, as in2110. For example, the system may receive an explicit request to splitthe partition from a client/user or system administrator, or such arequest may be automatically generated in the system in response todetecting an anomaly (as described in more detail below). As describedabove, in some embodiments, splitting a partition may involve creatingadditional replicas of the partition, dividing the resulting collectionof partition replicas into two or more new replica groups, and thendesignating each of the replica groups as managers of a respectiveportion of the original partition. Therefore, as illustrated at 2120, inresponse to receiving the request to split the partition, the system maybe configured to initiate creation of the one or more new partitionreplicas (which may be referred to as destination replicas), while oneor more of the original replicas of the source partition are live (i.e.while one or more of these replicas continue to accept and servicerequests directed to the partition). As illustrated at 2130, the methodmay include copying data from one or more source partition replicas tothe destination replicas using a physical copy mechanism (such as thatdescribed above). For example, the system may be configured to copy thetable partition data from one (or more) of the original replicas of thepartition to one or more of the destination replicas using a file copymechanism, in some embodiments. The method may also include bringing thenew replicas (once populated) up-to-date (e.g., by performing a catch-upoperation, as described above).

As illustrated in this example, the method may include propagating aspecial “write” command (i.e. a “split” command) to split the partitionby dividing the resulting collection of replicas into two or more newreplica groups and designating (and/or configuring) each replica groupas handling service requests directed to a respective portion of thesplit partition, as in 2140. In some embodiments, the system may takethe source replicas out of use briefly while the command to split thepartition replicas is propagated to the storage nodes on which theresulting collection of replicas are hosted. In other words, the systemmay not accept other service requests directed to the partition beingsplit while the split command is operating to configure the new replicagroups to receive subsequent service requests. In an example in which apartition is being split into two new partitions, the split command mayinstruct the replicas resulting from the copy operation to split in halfby designating each replica as belonging to the first half of the wordor the second half of the word, thus forming two new replica groups. Inother embodiments, the split command may designate each replica asbelonging to one of more than two replica groups. Note that in someembodiments, the special “split” command may not require any specialdurability.

As illustrated in this example, once the “split” command has beenpropagated and the new replica groups have been established, if thesystem is a single master system or a multi-master system, the methodmay include each of the new replica groups electing one or more mastersfor the replica group, as in 2150. Subsequently, the replicas in each ofthe new replica groups for the split partition (e.g., a replica groupmade up of the original replicas, a replica group made up of thedestination replicas, or a replica group made up of any other subset ofthe resulting replicas for the split partition) may handle requestsdirected to a respective portion of the original partition, as in 2160.For example, each of the replicas may reject requests for the table datathat is now out of its new smaller range, and may return an indicationthat the replica (or the node on which the replica is hosted) no longerhosts that data. As described above, in some embodiments, the system maybe configured to perform a logical reclamation of the unused portions ofthe resulting split partition replicas, as in 2170. For example, asrequests to store new items in the partition are received, these newitems may be stored in locations in the table that (following thereplica copying operation) held items stored in the original partition,but that are now being managed as part of a different partition (i.e.one of the two or more new partitions created by the split). In someembodiments, the system may employ a background process to logicallyfree up space within each of the resulting partition replicas, but thatspace may be consumed later if more items are added to the table thatare assigned to the new partition replicas according to their hash keyattribute values and/or range key attribute values. In some embodiments,a physical memory reclamation operation may be performed, which mayreturn a portion of the memory that was previously allocated to a largepartition replica prior to the split to the operating system. In suchembodiments, a de-fragmentation operation may also be performed.

As noted above, the partition moving process illustrated in FIG. 19 anddescribed above may be initiated automatically (e.g., programmatically)in response to detection of an anomaly in a system that implements adata storage service, in some embodiments. One embodiment of a methodfor moving a partition of a table being maintained by a data storageservice on behalf of a storage service client in response to detectingan anomaly is illustrated by the flow diagram in FIG. 22. As illustratedat 2210, in this example, the method may include a component of thesystem detecting a failure or fault on a physical computing node orstorage device that is hosting a replica of a partition of the table. Insome embodiments, if the partition replica hosted on the node on which afault or failure was detected was a master for its replica group, themethod may include electing a new master for the replica group, as in2220. In this example, the method may include the system initiatingcreation of a replacement partition replica while a source partitionreplica is live (i.e. while one or more of the replicas of the sourcepartition continue to accept and service requests directed to thepartition), as in 2230.

As illustrated in this example, the method may include copying a sourcepartition replica to the newly created replacement partition replicausing a physical copy mechanism (as in 2240), and performing a catch-upoperation to reconcile any changes to the partition data that are notyet reflected in the newly created replacement partition replica (as in2250). For example, the source partition replica may be copied to thereplacement partition replica using an operation that copies thephysical locations of the partition data, rather than using a logicalcopying operation (e.g., one that reads and copies table data on arow-by-row basis). In various embodiments, the partition replica on thefaulty machine may be used as the source partition replica, or one ormore other replicas for same partition (e.g., a replica in the samereplica group that is hosted on a working machine) may be used as thesource partition replica, e.g., depending type and/or severity of thedetected fault.

As noted above, the partition moving process described above andillustrated in FIGS. 19 and 20, and the partition splitting processillustrated in FIG. 21 and described above may be initiatedautomatically (e.g., programmatically) in response to detection of ananomaly in a system that implements a data storage service, in someembodiments. For example, if a hot spot develops on a particularcomputing node or storage device in the system underlying the datastorage service, the system may be configured to split a hot partitionfor which a replica is stored on that computing node or storage deviceand/or move one or more partition replicas stored on that computing nodeor storage device to another computing node or storage device. Oneembodiment of a method for splitting a partition or moving a replica ofa partition of a table being maintained by a data storage service onbehalf of a storage service client in response to detecting a hot spotis illustrated by the flow diagram in FIG. 23. As illustrated at 2310,in this example, the method may include a component of the systemdetecting a hot spot on a physical computing node or storage device thatis hosting a particular replica of a partition of the table. In otherwords, the system may detect that the computing node or storage deviceis experiencing a high level of traffic as compared to other computingnodes or storage devices in the system. In some cases, all or a portionof this heavy traffic may be directed to the particular partitionreplica itself, while in other cases the heavy traffic may be directedto other partition replicas, tables, or applications being hosted on thecomputing node or storage device.

As illustrated in this example, in response to detecting the hot spot,the system may be configured to move and/or split the particularpartition in an attempt to reduce the effects of the hot spot, such asby reducing latency, increasing overall throughput in the system, orotherwise improving the performance of the data storage service. If thehot spot is due to traffic targeting a single partition, shown as thepositive exit from 2315, the method may include initiating a split ofthat partition. In some embodiments, the system may be configured tocreate one or more new partition replicas (which may be referred to asdestination partition replicas), while one or more of the originalreplicas of the source partition are live (i.e. while one or more ofthese replicas continue to accept and service requests directed to thepartition), as in 2320. For example, the system may be configured tocreate one or destination replicas on computing nodes or storage devicesthat are not as heavily loaded as the one on which the hot spot wasdetected. As illustrated at 2330, the method may include copying thesource partition replica to the destination replicas using a physicalcopy mechanism (such as that described above). For example, the systemmay be configured to copy the table partition data from one of theoriginal replicas of the partition (e.g., the partition replica hostedon the heavily loaded computing node or storage device, or another oneof the replicas of the particular partition that is hosted on adifferent computing node or storage device) to one or more of thedestination replicas using a file copy mechanism, in some embodiments.The method may also include bringing the new replicas (once populated)up-to-date (e.g., by performing a catch-up operation, as describedabove), as in 2340.

In this example, the method may include propagating a special “split”command to split the hot partition, to create multiple new replicagroups, and to designate/configure each new replica group to handle arespective portion of the split partition, as in 2360. Subsequent to thepropagation of the “split” command, replicas in different ones of thenew replica groups may handle requests directed to respective portionsof the original partition. As illustrated at 2380, if the system is amastered system, the method may include electing a new master for eachof the new replica groups, as in 2380. As described above, in someembodiments, the system may be configured to perform a logicalreclamation of the unused portions of the resulting split partitionreplicas (not shown). In such embodiments, as requests to store newitems in the partition are received, these new items may be stored inlocations in the table that held items that were stored in the originalpartition replica, but that are now being managed as part of a differentpartition (by a replica in one of the new replica groups created by thesplit).

As illustrated in FIG. 23, if the hot spot is not due to traffictargeting a single partition (e.g., if it is due to traffic directed tomultiple partition replicas, tables, or applications being hosted on thecomputing node or storage device), the method may include initiating amove of one of the partition replicas to remove it from the high-trafficnode. This is illustrated in FIG. 23 by the negative exit form 2315. Inthis case, the method may include electing a new master for the replicagroup, if the system is a mastered system and if the replica being movedwas a master for its replica group (as in 2330). As illustrated in thisexample, the method may include creating a new replica on anothercomputing node or storage device while one or more replicas of thepartition whose replica is being moved are live, as in 2350. In someembodiments, the partition replica being moved may be copied to this newdestination replica using a physical copy mechanism (such as thatdescribed herein) and the destination replica may be brought up-to-dateusing a catch-up mechanism once the copy is complete, as in 2370. Oncethe destination replica has been populated and brought up to date, thepartition replica that was copied to a new destination may be removedfrom the high-traffic node, as in 2390. Subsequently, some or all of thetraffic directed to that partition may be directed to the destinationreplica on the other node (the less heavily loaded node).

Note that in some embodiments, in response to detecting a hot spot on acomputing node or storage device in a system that implements a datastorage service, the system may perform both a partition split and oneor more replica move(s). For example, after splitting a partition thatis experiencing heavy traffic, the replica for the split partition thatwas hosted on the hot node may also be moved from the hot node to a newhost node using the physical copy mechanism described herein. Inaddition, if any of the other replicas in either of the new replicagroups resulting from the partition split are hosted on hot nodes, theymay also be moved to other nodes. Note that in some embodiments, amethod similar to the method illustrated in FIG. 23 for moving and/orsplitting a partition may be applied in response to detecting anincreasing table size. For example, as more items are added to a giventable, such a method may be used to add new partitions (andcorresponding replicas thereof), and thus to provide automatic scalingof the table.

One embodiment of method for maintaining and managing a plurality oftables on behalf of one or more storage service clients is illustratedby the flow diagram in FIG. 24. As illustrated at 2410, in this example,the method may include detecting an anomaly in a system that implementsa data storage service while servicing requests from one or more storageservice clients. In some embodiments, the system may be configured toautomatically (e.g., programmatically) respond to the detection ofvarious types of anomalies, such as by scaling tables, movingpartitions, splitting partitions, and/or taking other actions notdescribed herein. For example, if a failed or faulty node (e.g., acomputing node or storage device) has been detected (as in 2420), thesystem may be configured to replace the failed or faulty node with a newnode and/or to move any or all partitions that are hosted on the failedor faulty node to the new node (as in 2425). As described herein, such amove may in some embodiments be performed using a physical copyoperation. As previously noted, if a failed or faulty node hosted apartition replica that was a master for its replica group, the systemmay also be configured to elect a new master subsequent to copying thepartition to the new node.

If a hot spot or increasing table/partition size is detected (as in2430), the system may be configured to add one or more new partitionsand corresponding replicas (e.g., on computing nodes or storage devicesother than the one on which the hot spot was detected), and to moveand/or split data that was hosted on the heavily loaded computing nodeor storage device in one or more of the new partitions or replicas (asin 2435). Similarly, if the system has detected that a best effortthroughput target (or another user preference) is not being met or is indanger of not being met due to increasing traffic or if the data volumeis increasing beyond a targeted capacity for the table (as in 2440), thesystem may be configured to throttle incoming service requests whileattempting to correct the situation. Again, the system may be configuredto add one or more new partitions and corresponding replicas (e.g., oncomputing nodes or storage devices other than the one on which the hotspot was detected), and to move and/or split data that was hosted on theheavily loaded computing node or storage device in one or more of thenew partitions or replicas (as in 2445). Similarly, if a liverepartition is explicitly requested (e.g., by a table owner), as in2450, the system may be configured to add or remove one or more newpartitions and corresponding replicas accordingly, or to move and/orsplit data that was hosted on a heavily loaded computing node or storagedevice in one or more of new partitions or replicas (as in 2455).

If another type of anomaly has been detected (shown as the negativeoutputs of 2420, 2430, 2440, and 2450) and the system has responded toand/or returned an indicator of that anomaly (as in 2460), or once thesystem has initiated as response to one of the anomalies described above(as in 2425, 2435, 2445, or 2455), the system may continue servicingincoming requests, as in 2465. In some embodiments, the system may beconfigured to continue operation (e.g., to continue servicing incomingservice requests), as in 2465, until or unless additional anomalies aredetected. This is illustrated in FIG. 24 by the feedback from 2470 to2465. If any additional anomalies are detected, shown as the positiveexit from 2470, any or all of the operations shown as 2420-2460 may berepeated by the system in order to maintain and manage tables on behalfof data storage service clients. This is illustrated in FIG. 24 by thefeedback from 2470 to 2420. Note that in some embodiments, any or all ofthe operations illustrated in FIG. 24 may be performed pro-actively (andautomatically) by background tasks while the data storage service is inoperation, and may not necessarily be performed in response to receivingany particular service requests.

One computing node that may be suitable for implementation of a datastorage service that employs the techniques described herein isillustrated in FIG. 25. Computing node 2500 may include functionality toprovide any or all of the components of a system that implements such adata storage service, or multiple computing nodes similar to ordifferent from computing node 2500 may collectively provide thisfunctionality, in different embodiments. For example, in variousembodiments, one or more computing nodes 2500 may implement any numberof storage service clients 110, a front end module 140, any number ofauto admin instances 150, any number of storage devices (such as storagenode instances 160), and/or any other components of a Web servicesplatform 130, an auto admin cluster, or external resources that interactwith Web services platform 130 (such as simple workflow component 170 orexternal storage service 180). In some embodiments that include multiplecomputing nodes 2500, all of the computing nodes 2500 may include thesame or similar hardware components, software components, andfunctionality, while in other embodiments, the computing nodes 2500comprising a computing system configured to implement the functionalitydescribed herein may include a wide variety of hardware components,software components, and functionality. In some embodiments, multiplecomputing nodes 2500 that collectively implement a data storage servicemay be components of a larger shared resource system or grid computingsystem.

In the illustrated embodiment, computing node 2500 includes one or moreprocessors 2510 coupled to a system memory 2520 via an input/output(I/O) interface 2530. Computing node 2500 further includes a networkinterface 2540 coupled to I/O interface 2530, and one or moreinput/output devices 2550. As noted above, in some embodiments, a givennode may implement the functionality of more than one component of asystem that manages and maintains data in tables (e.g., in anon-relational database) on behalf of data storage service clients, suchas that described herein. In various embodiments, a computing node 2500may be a uniprocessor system including one processor 2510, or amultiprocessor system including several processors 2510 (e.g., two,four, eight, or another suitable number). Processors 2510 may be anysuitable processor capable of executing instructions. For example, invarious embodiments processors 2510 may be general-purpose or embeddedprocessors implementing any of a variety of instruction setarchitectures (ISAs), such as the x86, PowerPC, SPARC, or MIPS ISAs, orany other suitable ISA. In multiprocessor systems, each of processors2510 may commonly, but not necessarily, implement the same ISA.Similarly, in a distributed computing system such as one thatcollectively implements a data storage service, each of the computingnodes may implement the same ISA, or individual computing nodes and/orreplica groups of nodes may implement different ISAs.

In some embodiments, system memory 2520 may include a non-transitory,computer-readable storage medium configured to store programinstructions and/or data accessible by processor(s) 2510. In variousembodiments, system memory 2520 may be implemented using any suitablememory technology, such as static random access memory (SRAM),synchronous dynamic RAM (SDRAM), nonvolatile/Flash-type memory, or anyother type of memory. In the illustrated embodiment, programinstructions and data implementing desired functions, such as thosedescribed above, are shown stored within system memory 2520 as programinstructions 2525 and data storage 2535, respectively. For example,program instruction 2525 may include program instructions that whenexecuted on processor(s) 2510 implement any or all of a storage serviceclient 110, a front end module 140 (which may include a user interface),an auto admin instance 150, a storage node instance 160, an adminconsole 265, a request router, a staging host, one or more metadatatables, a simple workflow component 170, an external storage service180, and/or any other components, modules, or sub-modules of a systemthat provides the data storage service described herein. Programinstructions 2525 may also include program instructions configured toimplement additional functionality of a system that implements a datastorage service not described herein.

Data storage 2535 may in various embodiments include collections of datamaintained by a data storage service on behalf of its clients/users,and/or metadata used by a computing system that implements such aservice, as described herein (including, but not limited to, tablesmanaged and maintained on behalf of clients/users of the service,metadata tables, business rules, partition maps, routing tables,indexes, namespaces and/or partitions thereof, service level agreementparameter values, subscriber preferences and/or account information,performance data, and/or resource usage data). In other embodiments,program instructions and/or data as described herein for implementing adata storage service that employs the techniques described above may bereceived, sent or stored upon different types of computer-readable mediaor on similar media separate from system memory 2520 or computing node2500. Generally speaking, a computer-readable medium may include storagemedia or memory media such as magnetic or optical media, e.g., disk orCD/DVD-ROM coupled to computing node 2500 via I/O interface 2530.Program instructions and data stored on a computer-readable storagemedium may be transmitted to a computing node 2500 for execution by aprocessor 2510 a by transmission media or signals such as electrical,electromagnetic, or digital signals, which may be conveyed via acommunication medium such as a network and/or a wireless link, such asmay be implemented via network interface 2540.

In one embodiment, I/O interface 2530 may be configured to coordinateI/O traffic between processor(s) 2510, system memory 2520, and anyperipheral devices in the computing node, including network interface2540 or other peripheral interfaces, such as input/output devices 2550.In some embodiments, I/O interface 2530 may perform any necessaryprotocol, timing or other data transformations to convert data signalsfrom one component (e.g., system memory 2520) into a format suitable foruse by another component (e.g., processor 2510). In some embodiments,I/O interface 2530 may include support for devices attached throughvarious types of peripheral buses, such as a variant of the PeripheralComponent Interconnect (PCI) bus standard or the Universal Serial Bus(USB) standard, for example. In some embodiments, the function of I/Ointerface 2530 may be split into two or more separate components, suchas a north bridge and a south bridge, for example. Also, in someembodiments some or all of the functionality of I/O interface 2530, suchas an interface to system memory 2520, may be incorporated directly intoprocessor 2510.

Network interface 2540 may be configured to allow data to be exchangedbetween computing node 2500 and other devices attached to a network(such as other computer systems, communication devices, input/outputdevices, or external storage devices), or between other nodes in asystem providing shared computing services. In various embodiments,network interface 2540 may support communication via wired or wirelessgeneral data networks, such as any suitable type of Ethernet network,for example; via telecommunications/telephony networks such as analogvoice networks or digital fiber communications networks; via storagearea networks such as Fibre Channel SANs, or via any other suitable typeof network and/or protocol.

Input/output devices 2550 may, in some embodiments, include one or moredisplay terminals, keyboards, keypads, touchpads, scanning devices,voice or optical recognition devices, or any other devices suitable forentering or retrieving data by one or more computing nodes 2500.Multiple input/output devices 2550 may be present in computing node 2500or may be distributed on various computing nodes of a system that isconfigured to implement a data storage service. In some embodiments,similar input/output devices may be separate from computing node 2500and may interact with one or more computing nodes of a system through awired or wireless connection, such as over network interface 2540.

Storage service clients (e.g., users, subscribers and/or clientapplications) may interact with a data storage service such as thatdescribed herein in various ways in different embodiments, such as tosubmit requests for service (including, but not limited to, requests tostore, retrieve and/or update items in tables, or requests torepartition a table), and to receive results. For example, somesubscribers to the service may have physical access to computing node2500, and if so, may interact with various input/output devices 2550 toprovide and/or receive information. Alternatively, other clients/usersmay use client computing systems to access the system, such as remotelyvia network interface 2540 (e.g., via the Internet and/or the World WideWeb). In addition, some or all of the computing nodes of a systemproviding the service may provide various feedback or other generaltypes of information to clients/users (e.g., in response to userrequests) via one or more input/output devices 2550.

Those skilled in the art will appreciate that computing node 2500 ismerely illustrative and is not intended to limit the scope ofembodiments. In particular, the computing system and devices may includeany combination of hardware or software that can perform the indicatedfunctions, including computers, network devices, internet appliances,PDAs, wireless phones, pagers, etc. Computing node 2500 may also beconnected to other devices that are not illustrated, in someembodiments. In addition, the functionality provided by the illustratedcomponents may in some embodiments be combined in fewer components ordistributed in additional components. Similarly, in some embodiments thefunctionality of some of the illustrated components may not be providedand/or other additional functionality may be available.

Those skilled in the art will also appreciate that, while various itemsare illustrated as being stored in memory or on storage while beingused, these items or portions of them may be transferred between memoryand other storage devices for purposes of memory management and dataintegrity. Alternatively, in other embodiments some or all of thesoftware components may execute in memory on another device andcommunicate with the illustrated computing system via inter-computercommunication. Some or all of the system components or data structuresmay also be stored (e.g., as instructions or structured data) on acomputer-readable storage medium or a portable article to be read by anappropriate drive, various examples of which are described above. Insome embodiments, instructions stored on a computer-readable storagemedium separate from computing node 2500 may be transmitted to computingnode 2500 via transmission media or signals such as electrical,electromagnetic, or digital signals, conveyed via a communication mediumsuch as a network and/or a wireless link. Various embodiments mayfurther include receiving, sending or storing instructions and/or dataimplemented in accordance with the foregoing description upon acomputer-readable storage medium. Accordingly, different embodiments maybe practiced with other computer system configurations.

Note that while several examples described herein are directed to theapplication of various techniques in systems that include anon-relational database, in other embodiments these techniques may beapplied in systems in which the non-relational data store is implementedusing a different storage paradigm.

Those skilled in the art will appreciate that in some embodiments thefunctionality provided by the methods discussed above may be provided inalternative ways, such as being split among more software modules orroutines or consolidated into fewer modules or routines. Similarly, insome embodiments illustrated methods may provide more or lessfunctionality than is described, such as when other illustrated methodsinstead lack or include such functionality respectively, or when theamount of functionality that is provided is altered. In addition, whilevarious operations may be illustrated as being performed in a particularmanner (e.g., in serial or in parallel) and/or in a particular order,those skilled in the art will appreciate that in other embodiments theoperations may be performed in other orders and in other manners. Thoseskilled in the art will also appreciate that the data structuresdiscussed above may be structured in different manners, such as byhaving a single data structure split into multiple data structures or byhaving multiple data structures consolidated into a single datastructure. Similarly, in some embodiments illustrated data structuresmay store more or less information than is described, such as when otherillustrated data structures instead lack or include such informationrespectively, or when the amount or types of information that is storedis altered. The various methods as depicted in the figures and describedherein represent illustrative embodiments of methods. The methods may beimplemented in software, in hardware, or in a combination thereof invarious embodiments. Similarly, the order of any method may be changed,and various elements may be added, reordered, combined, omitted,modified, etc., in various embodiments.

From the foregoing it will be appreciated that, although specificembodiments have been described herein for purposes of illustration,various modifications may be made without deviating from the spirit andscope of the appended claims and the elements recited therein. Inaddition, while certain aspects are presented below in certain claimforms, the inventors contemplate the various aspects in any availableclaim form. For example, while only some aspects may currently berecited as being embodied in a computer readable storage medium, otheraspects may likewise be so embodied. Various modifications and changesmay be made as would be obvious to a person skilled in the art havingthe benefit of this disclosure. It is intended to embrace all suchmodifications and changes and, accordingly, the above description to beregarded in an illustrative rather than a restrictive sense.

What is claimed is:
 1. A system, comprising: a plurality of computingnodes, each comprising at least one processor and memory, wherein theplurality of computing nodes is configured to implement a data storageservice; wherein the data storage service is configured to provide aservice interface through which service requests are received; whereinthe data storage service is configured to maintain a plurality of tablesin a data store on behalf of one or more storage service clients, andwherein to maintain the plurality of tables the data storage service isconfigured to maintain two or more replicas of table data stored in eachof one or more partitions on respective computing nodes in the datastore; wherein the data storage service is configured to move aparticular partition replica from a computing node that hosts theparticular partition replica to another computing node, wherein to movethe particular partition replica, the data storage service is configuredto: copy, by a physical file copy mechanism and while the particularpartition replica is live, one or more pages containing table data froma physical storage device of the computing node that hosts theparticular partition replica to a destination replica on a physicalstorage device of the other computing node; configure the destinationreplica to receive and service requests targeting at least a portion ofthe table data that was maintained on the particular partition replica;and direct service requests targeting the at least a portion of thetable data that was maintained on the particular partition replica awayfrom the particular partition replica.
 2. The system of claim 1, whereinto move the particular partition replica, the data storage service isfurther configured to: determine, prior to copying the table data, thecomputing node on which to create the destination replica.
 3. The systemof claim 1, wherein to copy the one or more pages containing table data,the data storage service is configured to: read the table data from theone or more pages of the physical storage device in which the contentsof the particular partition replica are stored; and write the copiedtable data to corresponding pages of the physical storage device of theother computing node that are allocated to the destination replica. 4.The system of claim 1, wherein to copy the one or more pages containingtable data, the data storage service is further configured to: logservice requests to modify table data stored in the particular partitionreplica that are received during copying; and apply one or more loggedservice requests to the particular partition replica at pre-determinedcheckpoint intervals during copying.
 5. The system of claim 4, whereinthe data storage service is further configured to: perform, subsequentto copying all of the table data maintained on the particular partitionreplica to the destination replica and prior to configuring thedestination replica to receive and service requests, a catch-upoperation to apply any service requests to modify table data maintainedon the particular partition replica that were received during copyingand that are not reflected in the destination replica to the destinationreplica; and wherein the catch-up operation applies any of the loggedservice requests that are not reflected in the destination replica tothe destination replica.
 6. A method, comprising: performing by acomputer: making a copy of a particular partition replica maintained ina data store, wherein the data store maintains a plurality of tables,and wherein maintaining the plurality of tables comprises maintainingone or more replicas of table data stored in each of one or morepartitions on respective computing nodes in the data store, wherein saidmaking a copy comprises: creating a destination replica on a computingnode other than a computing node on which the particular partitionreplica is hosted; copying, by a physical file copy mechanism and whilethe particular partition replica is live, table data maintained on theparticular partition replica to the destination replica on the othercomputing node, wherein said copying comprises: reading table data fromphysical storage locations in which the contents of the particularpartition replica are stored; and writing the read table data tocorresponding locations in physical storage allocated to the destinationreplica.
 7. The method of claim 6, wherein said making a copy isperformed in response to receiving a request to move or copy the tabledata maintained on the particular partition replica.
 8. The method ofclaim 6, wherein said copying further comprises: logging requests tomodify table data stored in the particular partition replica that arereceived during said copying; and during said copying, applying one ormore logged requests to the particular partition replica atpre-determined checkpoint intervals.
 9. The method of claim 8, furthercomprising: subsequent to copying all of the table data maintained onthe particular partition replica to the destination replica, performinga catch-up operation to apply any requests to modify table datamaintained on the particular partition replica that were received duringsaid copying and that are not reflected in the destination replica tothe destination replica; wherein the catch-up operation applies any ofthe logged requests that are not reflected in the destination replica tothe destination replica.
 10. The method of claim 9, further comprising:subsequent to said performing the catch-up operation: configuring thedestination replica to receive and service requests targeting table datathat was maintained on the particular partition replica; and directingrequests targeting table data that was maintained on the particularpartition replica away from the particular partition replica.
 11. Themethod of claim 6, further comprising: prior to said copying the tabledata, determining the computing node on which to create the destinationreplica.
 12. The method of claim 6, further comprising: determiningwhether the particular partition replica was a master for its replicagroup; and in response to determining that the particular partitionreplica was a master for its replica group, electing a new master forthe replica group.
 13. The method of claim 6, further comprising, duringsaid copying, the particular partition replica and the one or more otherpartition replicas storing the same table data as the particularpartition replica continuing to service requests directed to the tabledata stored in the particular partition replica.
 14. The method of claim6, wherein said making a copy is performed as part of a move operationin response to detecting a fault or failure condition on a computingnode that hosts the particular partition replica.
 15. The method ofclaim 6, wherein said making a copy is performed in response todetecting a fault or failure condition on a computing node that hosts apartition replica in the same replica group as the particular partitionreplica.
 16. The method of claim 6, wherein said making a copy isperformed in response to receiving a request to move or copy theparticular partition replica; and wherein the computing node on whichthe destination replica is created is specified in the request.
 17. Themethod of claim 6, wherein said making a copy is performed as part of anoperation to split a partition.
 18. A non-transitory, computer-readablestorage medium storing program instructions that when executed on one ormore computers cause the one or more computers to perform: maintainingone or more tables in a data store on behalf of one or more storageservice clients, wherein maintaining the one or more tables comprisesmaintaining one or more replicas of table data stored in each of one ormore partitions on respective computing nodes in the data store;receiving a service request to move or copy the table data stored in aparticular one of the partitions; and in response to said receiving,making a copy of a replica of the particular partition, wherein saidmaking a copy comprises: creating a destination replica on a computingnode other than the one on which the particular partition replica ishosted; and copying, while the particular partition replica is live,table data maintained on the particular partition replica to thedestination replica on the other computing node using a physical filecopy mechanism that copies table data from physical storage locations onthe computing node on which the particular replica is hosted tocorresponding locations in physical storage allocated to the destinationreplica.
 19. The storage medium of claim 18, wherein when executed onthe one or more computers, the program instructions further cause theone or more computers to perform: subsequent to copying all of the tabledata maintained on the particular partition replica to the destinationreplica, performing a catch-up operation to apply any service requeststo modify table data maintained on the particular partition replica thatwere received during said copying and that are not reflected in thedestination replica to the destination replica.
 20. The storage mediumof claim 18, wherein the service request is a request to move the tabledata; and wherein when executed on the one or more computers, theprogram instructions further cause the one or more computers to perform:subsequent to copying all of the table data maintained on the particularpartition replica to the destination replica: configuring thedestination replica to receive and service requests targeting table datathat was maintained on the particular partition replica; and directingservice requests targeting table data that was maintained on theparticular partition replica away from the particular partition replica.